CVE catalog

CVE-2026-49980

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD reque

[CVE catalog]

Severity
Critical · CVSS 9.8
Published
Source
[NVD] · [CVE record]
EPSS
0.78% · Oct 27, 2026

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrclonesid1.75.2-2fixed
Debianrclonetrixie1.60.1+dfsg-4vulnerable
Debianrclonebookworm1.60.1+dfsg-2vulnerable
CpercloneNot reportedNot reportedvulnerable
CpercloneNot reported1.74.3fixed
Gogithub.com/rclone/rcloneNot reported1.74.3fixed
Gogithub.com/ncw/rcloneNot reportedNot reportedunknown
Ubunturclonenoble1.60.1+dfsg-3ubuntu0.24.04.6fixed
Ubuntugolang-github-rclone-rclone-devnoble1.60.1+dfsg-3ubuntu0.24.04.6fixed
Ubunturclone22.041.53.3-1vulnerable
Ubunturclone22.041.53.3-2vulnerable
Ubunturclone22.041.53.3-4vulnerable
Ubunturclone22.041.53.3-4ubuntu1vulnerable
Ubunturclone22.041.53.3-4ubuntu1.22.04.1vulnerable
Ubunturclone22.041.53.3-4ubuntu1.22.04.2vulnerable
Ubunturclone22.041.53.3-4ubuntu1.22.04.3vulnerable
Ubunturclone22.041.53.3-4ubuntu1.22.04.4vulnerable
Ubunturclone22.041.53.3-4ubuntu1.22.04.5fixed
Ubunturclone24.041.60.1+dfsg-2build1vulnerable
Ubunturclone24.041.60.1+dfsg-3vulnerable
Ubunturclone24.041.60.1+dfsg-3ubuntu0.24.04.1vulnerable
Ubunturclone24.041.60.1+dfsg-3ubuntu0.24.04.2vulnerable
Ubunturclone24.041.60.1+dfsg-3ubuntu0.24.04.3vulnerable
Ubunturclone24.041.60.1+dfsg-3ubuntu0.24.04.4vulnerable
Ubunturclone24.041.60.1+dfsg-3ubuntu0.24.04.5vulnerable
Ubunturclone24.041.60.1+dfsg-3ubuntu0.24.04.6fixed
Ubunturclone26.041.60.1+dfsg-4ubuntu2vulnerable
Ubunturclone26.041.60.1+dfsg-4ubuntu3vulnerable
Ubunturclone26.041.60.1+dfsg-4ubuntu3.1vulnerable
Ubunturclone26.041.60.1+dfsg-4ubuntu3.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrclonesourcesid1.75.2-1not yet assignedNot reported[1140817]
Debianrclonesourcetrixie(unfixed)not yet assignedNot reported[1140817]
Debianrclonesourcebookworm(unfixed)not yet assignedNot reported[1140817]
CperclonecpeNot reported1.74.3Not reportedNot reportedNot reported
Gogithub.com/rclone/rcloneGoNot reported1.74.3Not reportedNot reportedNot reported
Ubunturclonedebnoble1.60.1+dfsg-3ubuntu0.24.04.6Not reportedNot reportedNot reported
Ubuntugolang-github-rclone-rclone-devdebnoble1.60.1+dfsg-3ubuntu0.24.04.6Not reportedNot reportedNot reported
Ubunturclonedeb22.041.53.3-4ubuntu1.22.04.5Not reportedUSN-8782-1Not reported
Ubunturclonedeb24.041.60.1+dfsg-3ubuntu0.24.04.6Not reportedUSN-8782-1Not reported
Ubunturclonedeb26.041.60.1+dfsg-4ubuntu3.2Not reportedUSN-8782-1Not reported

[Debian bug #1140817]

Notes

[trixie] rclone: Minor issue [bookworm] rclone: Limited support, minor issue; requires an rclone rcd --rc-serve listener reachable by the attacker without rc HTTP auth

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-rclone-rclone-dev]Affected

    Source package: [rclone]

    Details (2)

    • 1.60.1+dfsg-2 · all · bookworm

      Affected

      nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

    • 1.60.1+dfsg-2 · all · bookworm

      Affected

      nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

  • [rclone]Affected

    Source package: [rclone]

    Details (2)

    • 1.60.1+dfsg-2+b5 · amd64 · bookworm

      Affected

      nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

    • 1.60.1+dfsg-2+b5 · arm64 · bookworm

      Affected

      nvd · rclone · debian · bookworm; nvd · rclone · debian · 12

[Debian 13 (Trixie)]

  • [golang-github-rclone-rclone-dev]Affected

    Source package: [rclone]

    Details (2)

    • 1.60.1+dfsg-4 · all · trixie

      Affected

      nvd · rclone · debian · 13

    • 1.60.1+dfsg-4 · all · trixie

      Affected

      nvd · rclone · debian · 13

  • [rclone]Affected
    Details (2)

    • 1.60.1+dfsg-4 · amd64 · trixie

      Affected

      nvd · rclone · debian · 13

    • 1.60.1+dfsg-4 · arm64 · trixie

      Affected

      nvd · rclone · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]