CVE-2026-55183 Details
Description
RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.
A vulnerability in RClone Manager prior to version 0.2.7 allows for unauthorized cross-origin requests to be sent to a local RClone daemon. This issue arises because the application starts the RClone daemon with no authentication and permissive CORS settings, exposing sensitive configuration details and potentially allowing malicious file operations. The vulnerability could also lead to remote code execution, although this has not been confirmed.
Users can update to RClone Manager version 0.2.7 or later, which addresses this vulnerability by securing the RClone daemon credentials and configuration management.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Zarestia-Dev/rclone-manager/security/advisories/GHSA-f3qj-7hx5-q4c8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Zarestia-Dev/rclone-manager/commit/daa379498fc1aac453bcf1864d7ea072b80ffbe8 | [email protected] | Source CodeVendor |
| https://github.com/Zarestia-Dev/rclone-manager/releases/tag/v0.2.7 | [email protected] | Release NotesVendor |
| https://github.com/Zarestia-Dev/rclone-manager/security/advisories/GHSA-f3qj-7hx5-q4c8 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Zarestia-Dev RClone Manager | < 0.2.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |