Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution (CVE-2026-41176)
Rclone versions from 1.45.0 up to but not including 1.73.5 contain a critical vulnerability in the Remote Control (RC) server. The exposed RC endpoint 'options/set' lacks authentication enforcement, allowing unauthenticated attackers to disable authorization for other RC methods. This enables unauthorized access to sensitive administrative functions and potentially command execution. The vulnerability is patched in version 1.73.5.
AI Analysis
Technical Summary
Rclone's RC endpoint 'options/set' is exposed without requiring authentication, permitting an unauthenticated attacker to set 'rc.NoAuth=true'. This disables authorization checks for many RC methods that normally require authentication, on RC servers started without global HTTP authentication. This flaw affects Rclone versions >=1.45.0 and <1.73.5. Exploitation allows unauthorized access to administrative and operational RC methods, including configuration changes and command execution. The issue is fixed in version 1.73.5.
Potential Impact
An unauthenticated attacker can bypass RC server authorization controls, gaining unauthorized access to sensitive administrative functions and potentially executing commands on the Rclone server. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability requires the RC server to be running without authentication, which is not the default in many deployments. Red Hat assesses the impact as Important for their products due to typical deployment configurations.
Mitigation Recommendations
A patch is available in Rclone version 1.73.5 that fixes this vulnerability. Users should upgrade to version 1.73.5 or later. Additionally, ensure the RC server is not started without authentication enabled. If upgrading is not immediately possible, configure the RC server to require authentication to prevent exploitation.
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution (CVE-2026-41176)
Description
Rclone versions from 1.45.0 up to but not including 1.73.5 contain a critical vulnerability in the Remote Control (RC) server. The exposed RC endpoint 'options/set' lacks authentication enforcement, allowing unauthenticated attackers to disable authorization for other RC methods. This enables unauthorized access to sensitive administrative functions and potentially command execution. The vulnerability is patched in version 1.73.5.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Rclone's RC endpoint 'options/set' is exposed without requiring authentication, permitting an unauthenticated attacker to set 'rc.NoAuth=true'. This disables authorization checks for many RC methods that normally require authentication, on RC servers started without global HTTP authentication. This flaw affects Rclone versions >=1.45.0 and <1.73.5. Exploitation allows unauthorized access to administrative and operational RC methods, including configuration changes and command execution. The issue is fixed in version 1.73.5.
Potential Impact
An unauthenticated attacker can bypass RC server authorization controls, gaining unauthorized access to sensitive administrative functions and potentially executing commands on the Rclone server. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability requires the RC server to be running without authentication, which is not the default in many deployments. Red Hat assesses the impact as Important for their products due to typical deployment configurations.
Mitigation Recommendations
A patch is available in Rclone version 1.73.5 that fixes this vulnerability. Users should upgrade to version 1.73.5 or later. Additionally, ensure the RC server is not started without authentication enabled. If upgrading is not immediately possible, configure the RC server to require authentication to prevent exploitation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-rclone-2026-41176
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-41176"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Critical
Threat ID: 6a4c346f27e9c797196025ef
Added to database: 07/06/2026, 23:04:15 UTC
Last enriched: 09/08/2026, 15:11:34 UTC
Last updated: 09/13/2026, 22:01:33 UTC
Views: 82
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.