crítica
CVE-2026-41179
github.com/rclone/rclone: Rclone: Unauthenticated local command execution via exposed RC endpoint
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Julia9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Bitnami, Julia. Más baja según Red Hat (alta), Amazon (alta), Ubuntu (media).
Descripción
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | rclone | 1.73.5 |
| go::GitHub Security Advisory Go | github.com/rclone/rclone | 1.73.5 |
| julia::Julia Ecosystem Security Advisories | Rclone_jll | 1.73.5+0 |
| alpine 3.24 | rclone | 1.73.5-r0 |
| alpine edge | rclone | 1.73.5-r0 |
| amazon linux 2 | rclone, rclone-debuginfo | 1.55.1-1.amzn2.0.5 |
| amazon linux 2023 | rclone, rclone-debuginfo, rclone-debugsource | 1.73.5-75.amzn2023 |
| chainguard | telegraf-1.38, telegraf-1.39 | 1.38.4-r19 y 1 más |
| debian 12 | rclone | sin corrección indicada |
| debian 13 | rclone | sin corrección indicada |
| echo | rclone | sin corrección indicada |
| minimos | telegraf-1.39, telegraf-fips-1.39 | 1.39.1-r0 |
Mostrar las 39 entradas de 31 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | rclone | 1.73.5 |
| go::GitHub Security Advisory Go | github.com/rclone/rclone | 1.73.5 |
| julia::Julia Ecosystem Security Advisories | Rclone_jll | 1.73.5+0 |
| alpine 3.24 | rclone | 1.73.5-r0 |
| alpine edge | rclone | 1.73.5-r0 |
| amazon linux 2 | rclone | 1.55.1-1.amzn2.0.5 |
| amazon linux 2 | rclone-debuginfo | 1.55.1-1.amzn2.0.5 |
| amazon linux 2023 | rclone | 1.73.5-75.amzn2023 |
| amazon linux 2023 | rclone-debuginfo | 1.73.5-75.amzn2023 |
| amazon linux 2023 | rclone-debugsource | 1.73.5-75.amzn2023 |
| chainguard | telegraf-1.38 | 1.38.4-r19 |
| chainguard | telegraf-1.39 | 1.39.1-r0 |
| debian 12 | rclone | sin corrección indicada |
| debian 13 | rclone | sin corrección indicada |
| echo | rclone | sin corrección indicada |
| minimos | telegraf-1.39 | 1.39.1-r0 |
| minimos | telegraf-fips-1.39 | 1.39.1-r0 |
| rapidfort alpine 3.20 | rclone | 1.73.5-r0 |
| rapidfort alpine 3.21 | rclone | 1.73.5-r0 |
| rapidfort alpine 3.22 | rclone | 1.73.5-r0 |
| rapidfort alpine 3.23 | rclone | 1.73.5-r0 |
| rapidfort alpine 3.24 | rclone | 1.73.5-r0 |
| rapidfort amazon linux 2023 | rclone | 1.73.5-75.amzn2023 |
| rapidfort debian 12 | rclone | 0:1.75.2-1 |
| rapidfort debian 13 | rclone | 0:1.75.2-1 |
| rapidfort fedora 43 | rclone | 1.74.0-2.fc43 |
| rapidfort fedora 43 | restic | 0.19.0-1.fc43 |
| rapidfort Oracle Linux 10 | rclone | 1.74.0-2.el10_2 |
| rapidfort Oracle Linux 10 | restic | 0.19.0-1.el10_2 |
| rapidfort Oracle Linux 9 | rclone | 1.74.0-2.el9 |
| rapidfort Oracle Linux 9 | restic | 0.19.0-1.el9 |
| rapidfort ubuntu 20.04 | rclone | 0:1.60.1+dfsg-3ubuntu0.24.04.5 |
| rapidfort ubuntu 22.04 | rclone | 0:1.60.1+dfsg-3ubuntu0.24.04.5 |
| rapidfort ubuntu 24.04 | rclone | 0:1.60.1+dfsg-3ubuntu0.24.04.5 |
| ubuntu 24.04 | rclone | 1.60.1+dfsg-3ubuntu0.24.04.5 |
| ubuntu 25.10 | rclone | 1.60.1+dfsg-4ubuntu2.1 |
| ubuntu 26.04 | rclone | 1.60.1+dfsg-4ubuntu3.1 |
| ubuntu 26.10 | rclone | sin corrección indicada |
| wolfi | telegraf-1.38 | 1.38.4-r19 |
Referencias
- https://access.redhat.com/security/cve/CVE-2026-41179
- https://bugzilla.redhat.com/show_bug.cgi?id=2460988
- https://github.com/advisories/GHSA-jfwf-28xr-xw6q
- https://github.com/rclone/rclone
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go
- https://github.com/rclone/rclone/commit/2a9e952b38e03a96bf40c9eb6e8e22199865ee3b
Las 15 referencias
- https://github.com/rclone/rclone/releases/tag/v1.73.5
- https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q
- https://nvd.nist.gov/vuln/detail/CVE-2026-41179
- https://rclone.org/changelog/#v1-73-5-2026-04-19
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41179.json
- https://ubuntu.com/security/notices/USN-8299-1
- https://www.cve.org/CVERecord?id=CVE-2026-41179