Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M

CVE-2026-49980Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

Critical 9.8

In plain English

A critical-severity missing authentication in rclone from rclone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.8%top 43.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	rclone	no fix listed	DEBIAN-CVE-2026-49980
Debian:13	rclone	no fix listed	DEBIAN-CVE-2026-49980
Go	github.com/ncw/rclone	no fix listed	GO-2026-5596
Go	github.com/rclone/rclone	1.74.3	GHSA-qw24-gh76-8rvv
Go	github.com/rclone/rclone	1.74.3	GO-2026-5596
Ubuntu:22.04:LTS	rclone	1.53.3-4ubuntu1.22.04.5	USN-8782-1
Ubuntu:22.04:LTS	rclone	1.53.3-4ubuntu1.22.04.5	UBUNTU-CVE-2026-49980
Ubuntu:24.04:LTS	rclone	1.60.1+dfsg-3ubuntu0.24.04.6	USN-8782-1
Ubuntu:24.04:LTS	rclone	1.60.1+dfsg-3ubuntu0.24.04.6	UBUNTU-CVE-2026-49980
Ubuntu:25.10	rclone	no fix listed	UBUNTU-CVE-2026-49980
Ubuntu:26.04:LTS	rclone	1.60.1+dfsg-4ubuntu3.2	UBUNTU-CVE-2026-49980
Ubuntu:26.04:LTS	rclone	1.60.1+dfsg-4ubuntu3.2	USN-8782-1
Ubuntu:26.10	rclone	no fix listed	UBUNTU-CVE-2026-49980

Affected products (as reported)

Vendor	Product	Versions
rclone	rclone	>= 1.46.0, < 1.74.3

Weakness: CWE-306, CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2026-49980 vdb-entry, x_refsource_REDHAT
RHBZ#2492478 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49980.json x_sadp-csaf-vex