CVE-2026-41179
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
In Rclone from version 1.48.0 to 1.73.4, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. An unauthenticated attacker can exploit this to execute arbitrary local commands on the server via the WebDAV backend, which runs `bearer_token_command` during initialization.
Risk Assessment
The risk for the organization includes remote code execution by an unauthenticated attacker, potentially leading to server compromise, data theft, or further attacks on the infrastructure.
Recommendation
Immediately update Rclone to version 1.73.5 or later. If updating is not possible, restrict access to the RC endpoint via global HTTP authentication or a firewall.
Original NVD description (English source)
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.