CVE-2026-41179
github.com/rclone/rclone: Rclone: Unauthenticated local command execution via exposed RC endpoint
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Bitnami, Julia. Rated lower by Red Hat (high), Amazon (high), Ubuntu (medium).
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | rclone | 1.73.5 |
| go::GitHub Security Advisory Go | github.com/rclone/rclone | 1.73.5 |
| julia::Julia Ecosystem Security Advisories | Rclone_jll | 1.73.5+0 |
| alpine 3.24 | rclone | 1.73.5-r0 |
| alpine edge | rclone | 1.73.5-r0 |
| amazon linux 2 | rclone, rclone-debuginfo | 1.55.1-1.amzn2.0.5 |
| amazon linux 2023 | rclone, rclone-debuginfo, rclone-debugsource | 1.73.5-75.amzn2023 |
| chainguard | telegraf-1.38, telegraf-1.39 | 1.38.4-r19 and 1 more |
| debian 12 | rclone | no fix listed |
| debian 13 | rclone | no fix listed |
| echo | rclone | no fix listed |
| minimos | telegraf-1.39, telegraf-fips-1.39 | 1.39.1-r0 |
Show all 39 entries from 31 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | rclone | 1.73.5 |
| go::GitHub Security Advisory Go | github.com/rclone/rclone | 1.73.5 |
| julia::Julia Ecosystem Security Advisories | Rclone_jll | 1.73.5+0 |
| alpine 3.24 | rclone | 1.73.5-r0 |
| alpine edge | rclone | 1.73.5-r0 |
| amazon linux 2 | rclone | 1.55.1-1.amzn2.0.5 |
| amazon linux 2 | rclone-debuginfo | 1.55.1-1.amzn2.0.5 |
| amazon linux 2023 | rclone | 1.73.5-75.amzn2023 |
| amazon linux 2023 | rclone-debuginfo | 1.73.5-75.amzn2023 |
| amazon linux 2023 | rclone-debugsource | 1.73.5-75.amzn2023 |
| chainguard | telegraf-1.38 | 1.38.4-r19 |
| chainguard | telegraf-1.39 | 1.39.1-r0 |
| debian 12 | rclone | no fix listed |
| debian 13 | rclone | no fix listed |
| echo | rclone | no fix listed |
| minimos | telegraf-1.39 | 1.39.1-r0 |
| minimos | telegraf-fips-1.39 | 1.39.1-r0 |
| rapidfort alpine 3.20 | rclone | 1.73.5-r0 |
| rapidfort alpine 3.21 | rclone | 1.73.5-r0 |
| rapidfort alpine 3.22 | rclone | 1.73.5-r0 |
| rapidfort alpine 3.23 | rclone | 1.73.5-r0 |
| rapidfort alpine 3.24 | rclone | 1.73.5-r0 |
| rapidfort amazon linux 2023 | rclone | 1.73.5-75.amzn2023 |
| rapidfort debian 12 | rclone | 0:1.75.2-1 |
| rapidfort debian 13 | rclone | 0:1.75.2-1 |
| rapidfort fedora 43 | rclone | 1.74.0-2.fc43 |
| rapidfort fedora 43 | restic | 0.19.0-1.fc43 |
| rapidfort Oracle Linux 10 | rclone | 1.74.0-2.el10_2 |
| rapidfort Oracle Linux 10 | restic | 0.19.0-1.el10_2 |
| rapidfort Oracle Linux 9 | rclone | 1.74.0-2.el9 |
| rapidfort Oracle Linux 9 | restic | 0.19.0-1.el9 |
| rapidfort ubuntu 20.04 | rclone | 0:1.60.1+dfsg-3ubuntu0.24.04.5 |
| rapidfort ubuntu 22.04 | rclone | 0:1.60.1+dfsg-3ubuntu0.24.04.5 |
| rapidfort ubuntu 24.04 | rclone | 0:1.60.1+dfsg-3ubuntu0.24.04.5 |
| ubuntu 24.04 | rclone | 1.60.1+dfsg-3ubuntu0.24.04.5 |
| ubuntu 25.10 | rclone | 1.60.1+dfsg-4ubuntu2.1 |
| ubuntu 26.04 | rclone | 1.60.1+dfsg-4ubuntu3.1 |
| ubuntu 26.10 | rclone | no fix listed |
| wolfi | telegraf-1.38 | 1.38.4-r19 |
References
- https://access.redhat.com/security/cve/CVE-2026-41179
- https://bugzilla.redhat.com/show_bug.cgi?id=2460988
- https://github.com/advisories/GHSA-jfwf-28xr-xw6q
- https://github.com/rclone/rclone
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go
- https://github.com/rclone/rclone/commit/2a9e952b38e03a96bf40c9eb6e8e22199865ee3b
All 15 references
- https://github.com/rclone/rclone/releases/tag/v1.73.5
- https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q
- https://nvd.nist.gov/vuln/detail/CVE-2026-41179
- https://rclone.org/changelog/#v1-73-5-2026-04-19
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41179.json
- https://ubuntu.com/security/notices/USN-8299-1
- https://www.cve.org/CVERecord?id=CVE-2026-41179