CVE-2026-49980 Details
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.
A vulnerability in Rclone's remote control server feature allows for unauthenticated command execution. This issue affects Rclone versions 1.46.0 through 1.74.2. The vulnerability arises because the remote control server accepts unauthenticated GET and HEAD requests that can be crafted to execute commands as the user running the Rclone process. This exploitation is possible due to inline remote configuration options that execute local commands during the initialization of backends. Additionally, versions 1.55.0 and later are vulnerable to command execution, while earlier versions are susceptible to unauthenticated local file reads.
Users can upgrade to Rclone version 1.74.3 or 1.75.0 when released. Alternatively, Rclone's HTTP authentication can be configured on the remote control server using the '--rc-user' and '--rc-pass' options or by creating a password file with '--rc-htpasswd'. If file serving is not required, the '--rc-serve' option can be omitted.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-49980 | redhat-SADP | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2492478 | redhat-SADP | Issue TrackingThird Party Advisory |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49980.json | redhat-SADP | Third Party Advisory |
| https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| rclone rclone | >= 1.46, < 1.74.3 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 13, 2026 | CVE Modified | redhat-SADP |
| Jul 3, 2026 | CVE Modified | redhat-SADP |
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 27, 2026 | CVE Modified | redhat-SADP |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |