Vulnerability · Published Apr 23, 2026 · Assigned by GitHub_M
CVE-2026-41179RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
Critical 9.8
In plain English
A critical-severity OS command injection in rclone from rclone. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 8.6% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | rclone | 1.73.5-r0 | ALPINE-CVE-2026-41179 |
| Debian:12 | rclone | no fix listed | DEBIAN-CVE-2026-41179 |
| Debian:13 | rclone | no fix listed | DEBIAN-CVE-2026-41179 |
| Go | github.com/ncw/rclone | no fix listed | GO-2026-5466 |
| Go | github.com/rclone/rclone | 1.73.5 | GO-2026-5466 |
| Go | github.com/rclone/rclone | 1.73.5 | GHSA-jfwf-28xr-xw6q |
| Ubuntu:24.04:LTS | rclone | 1.60.1+dfsg-3ubuntu0.24.04.5 | UBUNTU-CVE-2026-41179 |
| Ubuntu:25.10 | rclone | 1.60.1+dfsg-4ubuntu2.1 | UBUNTU-CVE-2026-41179 |
| Ubuntu:26.04:LTS | rclone | 1.60.1+dfsg-4ubuntu3.1 | UBUNTU-CVE-2026-41179 |
| Ubuntu:26.10 | rclone | no fix listed | UBUNTU-CVE-2026-41179 |
Affected products (as reported)
Weakness: CWE-78, CWE-306, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q x_refsource_CONFIRM
- https://github.com/rclone/rclone/commit/2a9e952b38e03a96bf40c9eb6e8e22199865ee3b x_refsource_MISC
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go x_refsource_MISC
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go x_refsource_MISC
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go x_refsource_MISC
- https://github.com/rclone/rclone/releases/tag/v1.73.5 x_refsource_MISC
- https://rclone.org/changelog/#v1-73-5-2026-04-19 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-41179 vdb-entry, x_refsource_REDHAT
- RHBZ#2460988 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41179.json x_sadp-csaf-vex