Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-41176: Rclone: Unauthenticated Access to Sensitive Operations and Command Execution
Exploitation likelihood: 35%
GHSA-25qr-6mpr-f7qx
CVE-2026-41176
GHSA-25qr-6mpr-f7qx
GO-2026-4964
BIT-rclone-2026-41176
Summary
An attacker can access sensitive Rclone features without authentication if the remote control API is enabled and accessible. This can happen if the API is running without password protection. To mitigate, ensure the Rclone remote control API is not exposed to the internet and use strong authentication, such as passwords or HTTP authentication, to secure access to the API.
What to do
- Update github.com rclone to version 1.73.5.
- Update rclone github.com/rclone/rclone to version 1.73.5.
- Update rclone to version 1.73.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | rclone |
>= 1.45.0, < 1.73.5 Fix: upgrade to 1.73.5
|
| Go | rclone | github.com/rclone/rclone |
>= 1.45.0, < 1.73.5 < 1.73.5 Fix: upgrade to 1.73.5
|
| Bitnami | – | rclone |
>= 1.45.0, < 1.73.5 Fix: upgrade to 1.73.5
|
Original title
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
Original description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.
ghsa CVSS4.0
9.2
Vulnerability type
CWE-306
Missing Authentication for Critical Function
- https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx
- https://github.com/advisories/GHSA-25qr-6mpr-f7qx
- https://github.com/rclone/rclone Product
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/f...
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/f...
- https://nvd.nist.gov/vuln/detail/CVE-2026-41176
- https://access.redhat.com/security/cve/CVE-2026-41176 URL
- https://bugzilla.redhat.com/show_bug.cgi?id=2460989 URL
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41176.json URL
Published: 24 Apr 2026 · Updated: 6 Jul 2026 · First seen: 22 Apr 2026