BIT-rclone-2026-41176: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.
AI Analysis
Technical Summary
Rclone's remote control (RC) endpoint 'options/set' lacks authentication enforcement, enabling unauthenticated attackers to modify the runtime configuration by setting 'rc.NoAuth=true'. This effectively disables authorization checks on many RC methods that normally require authentication, allowing attackers to perform sensitive administrative operations and potentially execute commands on affected Rclone servers. The vulnerability affects versions starting from 1.45.0 up to but not including 1.73.5. The issue is resolved in version 1.73.5.
Potential Impact
An unauthenticated attacker can bypass RC authorization controls on Rclone servers that do not have global HTTP authentication enabled. This leads to unauthorized access to sensitive administrative and operational functions, including the ability to execute commands, which can compromise the confidentiality, integrity, and availability of the system.
Mitigation Recommendations
Upgrade Rclone to version 1.73.5 or later, which includes a patch for this vulnerability. For affected versions prior to 1.73.5, ensure that global HTTP authentication is enabled on RC servers to prevent unauthorized access. Patch status is confirmed by the vendor advisory indicating version 1.73.5 as the fixed release.
BIT-rclone-2026-41176: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Rclone's remote control (RC) endpoint 'options/set' lacks authentication enforcement, enabling unauthenticated attackers to modify the runtime configuration by setting 'rc.NoAuth=true'. This effectively disables authorization checks on many RC methods that normally require authentication, allowing attackers to perform sensitive administrative operations and potentially execute commands on affected Rclone servers. The vulnerability affects versions starting from 1.45.0 up to but not including 1.73.5. The issue is resolved in version 1.73.5.
Potential Impact
An unauthenticated attacker can bypass RC authorization controls on Rclone servers that do not have global HTTP authentication enabled. This leads to unauthorized access to sensitive administrative and operational functions, including the ability to execute commands, which can compromise the confidentiality, integrity, and availability of the system.
Mitigation Recommendations
Upgrade Rclone to version 1.73.5 or later, which includes a patch for this vulnerability. For affected versions prior to 1.73.5, ensure that global HTTP authentication is enabled on RC servers to prevent unauthorized access. Patch status is confirmed by the vendor advisory indicating version 1.73.5 as the fixed release.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-rclone-2026-41176
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-41176"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Critical
- Cvss Version
- null
Threat ID: 6a4c346f27e9c797196025ef
Added to database: 07/06/2026, 23:04:15 UTC
Last enriched: 07/06/2026, 23:36:03 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.