9.2
Critique
CVE-2026-41179 Rclone is a command-line program to sync files and directories to and from different cloud storage providers
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| rclone 1.48 | 1.48.0 → < 1.73.5 | 1.73.5 |
| OpenShift API for Data Protection | Versions non publiées | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions non publiées |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- rclone.org rclone.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de rclone
Les 42 CVE de rclone →
CVE-2026-116196
Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
6.0
Moyenne
CVE-2026-116195
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which…
7.0
Élevée
CVE-2026-116194
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost…
7.6
Élevée
CVE-2026-116192
rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
8.2
Élevée