Github.Com Rclone Rclone vulnerabilities

CVE-2026-41176 [CRITICAL] CWE-306 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution ### Summary The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. An unauthenticated attacker can set `rc.NoAuth=true`, which

CVE-2026-41179 [CRITICAL] CWE-306 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution ### Summary The RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can in

CVE-2026-49980 [CRITICAL] CWE-306 Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix ## Summary `rclone rcd --rc-serve` accepts unauthenticated `GET` and `HEAD` requests to paths of the form: ```text /[remote:path]/object ``` The `remote` value is parsed from the URL and passed to nor

CVE-2020-28924 [HIGH] CWE-331 Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the password

CVE-2024-52522 [MEDIUM] CWE-281 Rclone has Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata Rclone has Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata ### **tl;dr:** unprivileged user creates a symlink to /etc/sudoers, /etc/shadow or similar and waits for a privileged user or process to copy/backup/mirror users data (using `--links` and `--metadata`). unprivileged user now owns /etc/sudoers. ### Summary Insecu