CVE-2026-41176 PUBLISHED

Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

Assigner: GitHub_M
Reserved: 17.04.2026 Published: 22.04.2026 Updated: 22.04.2026

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint options/set is exposed without AuthRequired: true, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set rc.NoAuth=true, which disables the authorization gate for many RC methods registered with AuthRequired: true on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.2

Product Status

Vendor rclone
Product rclone
Versions
  • Version >= 1.45.0, < 1.73.5 is affected

References

Problem Types

  • CWE-306: Missing Authentication for Critical Function CWE