Executive brief
Rclone is a command-line tool used to synchronize files between different cloud storage providers. A security flaw in its remote control interface allows an unauthenticated attacker to execute arbitrary commands on the host system. This could lead to full system takeover, data theft, or unauthorized file manipulation if the remote control API is exposed without a password.
Technical details
The Rclone Remote Control (RC) API endpoint 'operations/fsinfo' was registered without the 'AuthRequired: true' flag, allowing unauthenticated access. This endpoint accepts an 'fs' parameter that supports inline backend definitions. An attacker can provide a crafted WebDAV backend configuration that includes the 'bearer_token_command' option. During backend initialization, Rclone executes the string provided in 'bearer_token_command' as a system command. This allows for single-request unauthenticated local command execution on any Rclone deployment where the RC API is reachable and global HTTP authentication is not enabled. The issue is fixed in version 1.73.5 by enforcing authentication on the affected endpoint.
Affected products
- Rclone Rclone 1.48.0 to 1.73.4
Timeline
- 2026-04-19: patched: Version 1.73.5 released
- 2026-04-19: advisory: GitHub Security Advisory GHSA-jfwf-28xr-xw6q published
- 2026-04-23: disclosed: CVE-2026-41179 published to NVD
References
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go
- https://github.com/rclone/rclone/commit/2a9e952b38e03a96bf40c9eb6e8e22199865ee3b
- https://github.com/rclone/rclone/releases/tag/v1.73.5
- https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q
- https://rclone.org/changelog/