CVE catalog

CVE-2026-41179

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
8.58% · Oct 25, 2026

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrclonesid1.75.2-2fixed
Debianrclonetrixie1.60.1+dfsg-4vulnerable
Debianrclonebookworm1.60.1+dfsg-2vulnerable
CpercloneNot reported1.60.1+dfsg-3ubuntu0.24.04.5fixed
Cpegolang-github-rclone-rclone-devNot reported1.60.1+dfsg-3ubuntu0.24.04.5fixed
CpercloneNot reportedNot reportedvulnerable
CpercloneNot reported1.73.5fixed
Gogithub.com/ncw/rcloneNot reportedNot reportedunknown
Gogithub.com/rclone/rcloneNot reported1.73.5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrclonesourcesid1.75.2-1not yet assignedNot reported[1134735]
Debianrclonesourcetrixie(unfixed)not yet assignedNot reported[1134735]
Debianrclonesourcebookworm(unfixed)not yet assignedNot reported[1134735]
CperclonecpeNot reported1.60.1+dfsg-3ubuntu0.24.04.5Not reportedNot reportedNot reported
Cpegolang-github-rclone-rclone-devcpeNot reported1.60.1+dfsg-3ubuntu0.24.04.5Not reportedNot reportedNot reported
CperclonecpeNot reported1.73.5Not reportedNot reportedNot reported
Gogithub.com/rclone/rcloneGoNot reported1.73.5Not reportedNot reportedNot reported

[Debian bug #1134735]

Notes

[trixie] rclone: Minor issue [bookworm] rclone: Limited support, minor issue; requires an rclone rc listener reachable by the attacker without rc HTTP auth

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-rclone-rclone-dev]Affected

    Source package: [rclone]

    Details (2)

    • 1.60.1+dfsg-2 · all · bookworm

      Affected

      nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

    • 1.60.1+dfsg-2 · all · bookworm

      Affected

      nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

  • [rclone]Affected

    Source package: [rclone]

    Details (2)

    • 1.60.1+dfsg-2+b5 · amd64 · bookworm

      Affected

      nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

    • 1.60.1+dfsg-2+b5 · arm64 · bookworm

      Affected

      nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

[Debian 13 (Trixie)]

  • [golang-github-rclone-rclone-dev]Affected

    Source package: [rclone]

    Details (2)

    • 1.60.1+dfsg-4 · all · trixie

      Affected

      nvd · rclone · debian · 13

    • 1.60.1+dfsg-4 · all · trixie

      Affected

      nvd · rclone · debian · 13

  • [rclone]Affected
    Details (2)

    • 1.60.1+dfsg-4 · amd64 · trixie

      Affected

      nvd · rclone · debian · 13

    • 1.60.1+dfsg-4 · arm64 · trixie

      Affected

      nvd · rclone · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]