# CVE-2026-41176: CVE-2026-41176

Status: published. Published: 2026-04-23. Updated: 2026-11-11.

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.

## Remediation

- fix: github.com/rclone/rclone (Go): OSV reports a fixed version 1.73.5. Check the advisory for supported release branches. (source: OSV GHSA-25qr-6mpr-f7qx) — https://github.com/advisories/GHSA-25qr-6mpr-f7qx

## Affected products and versions

- rclone / rclone: ≥ 1.45; < 1.73.5 (affected, custom). Source: NVD
-  / github.com/rclone/rclone (github.com/rclone/rclone): ≥ 1.45.0; < 1.73.5 (affected, semver); OSV events: introduced 1.45.0; fixed 1.73.5. Source: OSV GHSA-25qr-6mpr-f7qx

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "1.73.5",
            "versionStartIncluding": "1.45",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 4.0: 9.2 (critical); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: security-advisories@github.com

- CVSS 3.1: 9.8 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; source: NVD: nvd@nist.gov

- CVSS 3.1: 9.8 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; source: NVD: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation poc; automatable yes; technical impact total; source NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- Weaknesses: CWE-306, CWE-15

## Exploit evidence

- exploit: https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx (security-advisories@github.com)
- exploit: https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx (134c704f-9b21-4f2e-91b3-4a467353bcc0)

## References

- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/config.go (security-advisories@github.com; Product)

- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/rcserver/rcserver.go (security-advisories@github.com; Product)

- https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx (security-advisories@github.com; Exploit, Vendor Advisory)

- https://access.redhat.com/security/cve/CVE-2026-41176 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)

- https://bugzilla.redhat.com/show_bug.cgi?id=2460989 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)

- https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx (134c704f-9b21-4f2e-91b3-4a467353bcc0; Exploit, Vendor Advisory)

- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41176.json (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)

- https://github.com/advisories/GHSA-25qr-6mpr-f7qx (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-25qr-6mpr-f7qx (OSV / GitHub Security Advisories; osv)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41176; retrieved 2026-11-12; source updated 2026-11-11

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-25qr-6mpr-f7qx; retrieved 2026-11-12; source updated 2026-09-10

Revision: 5c91026dc01d545ce59a66708b38e0093a2f81ff41c02578dea616b626e0b181

Canonical: https://y2.dev/cve/CVE-2026-41176

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.