https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:12:35 +0000 https://cve.radiocsirt.org/vuln/bit-rclone-2026-41176 <p><strong>Affected:</strong> Bitnami: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.</p> <p><strong>Affected:</strong> Bitnami: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.</p> https://cve.radiocsirt.org/vuln/bit-rclone-2026-41176 https://cve.radiocsirt.org/vuln/euvd-2026-337258 EUVD-2026-337258 https://cve.radiocsirt.org/vuln/euvd-2026-337258 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41176 <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41176 https://cve.radiocsirt.org/vuln/ghsa-25qr-6mpr-f7qx <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>### Summary The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. An unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods.</p> <p>### Preconditions</p> <p>Preconditions for this vulnerability are:</p> <p>- The rclone remote control API **must** be enabled, either by the `--rc` flag or by running the `rclone rcd` server - The remote control API **must** be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use - The rc must have been deployed **without** global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc</p> <p>### Details The root cause is present from v1.45 onward. Some higher-impact exploitation paths became available in later releases as additional RC functionality was introduced.</p> <p>The issue is caused by two properties of the RC implementation:</p> <p>1. `options/set` is exposed without `AuthRequired: true` 2. the RC server enforces authorization for `AuthRequired` calls using the mutable runtime value `s.opt.NoAuth`</p> <p>Relevant code paths:</p> <p>- [`fs/rc/config.go`](https://github.com/rclone/rclone/blob/bf55d5e6d…</p> <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>### Summary The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. An unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods.</p> <p>### Preconditions</p> <p>Preconditions for this vulnerability are:</p> <p>- The rclone remote control API **must** be enabled, either by the `--rc` flag or by running the `rclone rcd` server - The remote control API **must** be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use - The rc must have been deployed **without** global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc</p> <p>### Details The root cause is present from v1.45 onward. Some higher-impact exploitation paths became available in later releases as additional RC functionality was introduced.</p> <p>The issue is caused by two properties of the RC implementation:</p> <p>1. `options/set` is exposed without `AuthRequired: true` 2. the RC server enforces authorization for `AuthRequired` calls using the mutable runtime value `s.opt.NoAuth`</p> <p>Relevant code paths:</p> <p>- [`fs/rc/config.go`](https://github.com/rclone/rclone/blob/bf55d5e6d…</p> https://cve.radiocsirt.org/vuln/ghsa-25qr-6mpr-f7qx https://cve.radiocsirt.org/vuln/opensuse-su-2026:10584-1 <p>rclone-1.73.5-1.1 on GA media</p> <p>rclone-1.73.5-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10584-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41176 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:22.04:LTS: rclone, Ubuntu:24.04:LTS: rclone, Ubuntu:25.10: rclone, Ubuntu:26.04:LTS: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:22.04:LTS: rclone, Ubuntu:24.04:LTS: rclone, Ubuntu:25.10: rclone, Ubuntu:26.04:LTS: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41176 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1179 <p>Ein Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um Sicherheitsvorkehrungen zu umgehen und beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um Sicherheitsvorkehrungen zu umgehen und beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1179