https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:02:34 +0000 https://cve.radiocsirt.org/vuln/bit-rclone-2026-49980 <p><strong>Affected:</strong> Bitnami: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.</p> <p><strong>Affected:</strong> Bitnami: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.</p> https://cve.radiocsirt.org/vuln/bit-rclone-2026-49980 https://cve.radiocsirt.org/vuln/euvd-2026-349696 EUVD-2026-349696 https://cve.radiocsirt.org/vuln/euvd-2026-349696 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49980 <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49980 https://cve.radiocsirt.org/vuln/ghsa-qw24-gh76-8rvv <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>## Summary</p> <p>`rclone rcd --rc-serve` accepts unauthenticated `GET` and `HEAD` requests to paths of the form:</p> <p>```text /[remote:path]/object ```</p> <p>The `remote` value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated `GET` or `HEAD` request can execute a command as the rclone process user.</p> <p>Versions from 1.55.0 onwards are vulnerable to command execution. Earlier versions (from 1.46.0) are vulnerable to the unauthenticated local file read described under &#34;Additional impact&#34; but not to command execution, because inline backend option overrides did not exist until 1.55.0.</p> <p>## Preconditions</p> <p>Preconditions for this vulnerability are:</p> <p>- The rclone remote control API must be enabled, either by the `--rc` flag or by running the `rclone rcd` server - The remote control API must be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use - The rc must have been deployed without global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc - The `--rc-serve` flag must be in use</p> <p>## Impact</p> <p>An unauthenticated network attacker who can reach the RC HTTP listener can execute commands as the rclone process user.</p> <p>Additional impact observed during testing:</p> <p>- `GET` and `HEAD` both trigger backend initialization. - The same path allows unauthenticated lo…</p> <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>## Summary</p> <p>`rclone rcd --rc-serve` accepts unauthenticated `GET` and `HEAD` requests to paths of the form:</p> <p>```text /[remote:path]/object ```</p> <p>The `remote` value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated `GET` or `HEAD` request can execute a command as the rclone process user.</p> <p>Versions from 1.55.0 onwards are vulnerable to command execution. Earlier versions (from 1.46.0) are vulnerable to the unauthenticated local file read described under &#34;Additional impact&#34; but not to command execution, because inline backend option overrides did not exist until 1.55.0.</p> <p>## Preconditions</p> <p>Preconditions for this vulnerability are:</p> <p>- The rclone remote control API must be enabled, either by the `--rc` flag or by running the `rclone rcd` server - The remote control API must be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use - The rc must have been deployed without global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc - The `--rc-serve` flag must be in use</p> <p>## Impact</p> <p>An unauthenticated network attacker who can reach the RC HTTP listener can execute commands as the rclone process user.</p> <p>Additional impact observed during testing:</p> <p>- `GET` and `HEAD` both trigger backend initialization. - The same path allows unauthenticated lo…</p> https://cve.radiocsirt.org/vuln/ghsa-qw24-gh76-8rvv https://cve.radiocsirt.org/vuln/opensuse-su-2026:10975-1 <p>rclone-1.74.3-1.1 on GA media</p> <p>rclone-1.74.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10975-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-49980 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:22.04:LTS: rclone, Ubuntu:24.04:LTS: rclone, Ubuntu:25.10: rclone, Ubuntu:26.04:LTS: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:22.04:LTS: rclone, Ubuntu:24.04:LTS: rclone, Ubuntu:25.10: rclone, Ubuntu:26.04:LTS: rclone</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-49980 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1811 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in rclone ausnutzen, um je nach rclone-Version beliebigen Code mit Benutzerrechten auszuführen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in rclone ausnutzen, um je nach rclone-Version beliebigen Code mit Benutzerrechten auszuführen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1811