Executive brief
Rclone is a command-line tool used to synchronize files between local storage and various cloud providers. A security flaw in its remote control interface allows an unauthenticated attacker to execute arbitrary commands or read local files on the system where Rclone is running. This could lead to a full system compromise, data theft, or unauthorized access to cloud storage credentials.
Technical details
Rclone's remote control daemon (rcd), when started with the --rc-serve flag, fails to properly authenticate GET and HEAD requests to paths using the /[remote:path]/object format. An attacker can provide a specially crafted 'remote' value containing inline configuration options that trigger backend initialization. In versions 1.55.0 through 1.74.2, these inline options can be used to execute local commands via backend-specific parameters. In earlier versions (starting from 1.46.0), the flaw can be used to read local files. The vulnerability is exploitable over the network if the RC API is exposed, or via cross-site subresource requests (e.g., an <img> tag) if the API is bound to localhost. The issue is resolved in version 1.74.3.
Affected products
- rclone rclone >= 1.46.0, < 1.74.3
Timeline
- 2026-06-05: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: NVD publication date
- 2026-06-24: patched: Fix released in version 1.74.3