CVE-2026-41179
CVE-2026-41179
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.
Fixes and workarounds
Fix
github.com/rclone/rclone (Go): OSV reports a fixed version 1.73.5. Check the advisory for supported release branches.
Source: OSV GHSA-jfwf-28xr-xw6qAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| rclone rclone |
≥ 1.48.0; < 1.73.5 (affected, custom) | NVD |
github.com/rclone/rclonegithub.com/rclone/rclone
Go |
≥ 1.48.0; < 1.73.5 (affected, semver); OSV events: introduced 1.48.0; fixed 1.73.5Source events (semver)Other versions: unaffected |
OSV GHSA-jfwf-28xr-xw6q |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
NVD applicability configurations (1)
These expressions retain AND/OR operators, negation, and required environmental products. A listed product is not sufficient to establish exposure when additional conditions apply.
[
{
"negate": false,
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.73.5",
"versionStartIncluding": "1.48.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
]CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 9.2 critical |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD: [email protected] |
| 3.1 / 9.8 critical |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD: [email protected] |
| 3.1 / 9.8 critical |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c |
Exploit evidence
- https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q
exploit · [email protected] - https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q
exploit · 134c704f-9b21-4f2e-91b3-4a467353bcc0
References
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go[email protected] · Product
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go[email protected] · Product
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go[email protected] · Product
- https://github.com/rclone/rclone/commit/2a9e952b38e03a96bf40c9eb6e8e22199865ee3b[email protected]
- https://github.com/rclone/rclone/releases/tag/v1.73.5[email protected]
- https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q[email protected] · Exploit, Vendor Advisory
- https://rclone.org/changelog/#v1-73-5-2026-04-19[email protected]
- https://access.redhat.com/security/cve/CVE-2026-411790b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://bugzilla.redhat.com/show_bug.cgi?id=24609880b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q134c704f-9b21-4f2e-91b3-4a467353bcc0 · Exploit, Vendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41179.json0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- https://github.com/advisories/GHSA-jfwf-28xr-xw6qOSV / GitHub Security Advisories · advisory
- https://osv.dev/vulnerability/GHSA-jfwf-28xr-xw6qOSV / GitHub Security Advisories · osv
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.