RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution (CVE-2026-41179)
Rclone versions from 1.48.0 up to but not including 1.73.5 contain a critical vulnerability in the Remote Control (RC) endpoint operations/fsinfo. This endpoint is exposed without authentication and accepts attacker-controlled input that allows instantiation of malicious backends. Specifically, the WebDAV backend executes a command during initialization, enabling unauthenticated local command execution on deployments where the RC server is running without authentication. The issue is patched in version 1.73.5.
AI Analysis
Technical Summary
Rclone's RC endpoint operations/fsinfo is exposed without authentication in versions >=1.48.0 <1.73.5. It accepts attacker-controlled fs input, which can instantiate arbitrary backends. The WebDAV backend executes the bearer_token_command during initialization, allowing an unauthenticated attacker to execute local commands on the host. Exploitation requires the RC server to be running (via rclone rcd or --rc flag) and deployed without authentication. This vulnerability is addressed in version 1.73.5.
Potential Impact
An unauthenticated attacker can execute arbitrary local commands on systems running vulnerable Rclone versions with the RC server enabled and no authentication configured. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. The vulnerability is critical due to the lack of authentication and the ability to execute commands remotely.
Mitigation Recommendations
Upgrade Rclone to version 1.73.5 or later, where this vulnerability is patched. Additionally, ensure that the RC server is not exposed without authentication; enable authentication for the RC server if it must be used. If upgrading immediately is not possible, restrict network access to the RC server to trusted hosts only.
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution (CVE-2026-41179)
Description
Rclone versions from 1.48.0 up to but not including 1.73.5 contain a critical vulnerability in the Remote Control (RC) endpoint operations/fsinfo. This endpoint is exposed without authentication and accepts attacker-controlled input that allows instantiation of malicious backends. Specifically, the WebDAV backend executes a command during initialization, enabling unauthenticated local command execution on deployments where the RC server is running without authentication. The issue is patched in version 1.73.5.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Rclone's RC endpoint operations/fsinfo is exposed without authentication in versions >=1.48.0 <1.73.5. It accepts attacker-controlled fs input, which can instantiate arbitrary backends. The WebDAV backend executes the bearer_token_command during initialization, allowing an unauthenticated attacker to execute local commands on the host. Exploitation requires the RC server to be running (via rclone rcd or --rc flag) and deployed without authentication. This vulnerability is addressed in version 1.73.5.
Potential Impact
An unauthenticated attacker can execute arbitrary local commands on systems running vulnerable Rclone versions with the RC server enabled and no authentication configured. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. The vulnerability is critical due to the lack of authentication and the ability to execute commands remotely.
Mitigation Recommendations
Upgrade Rclone to version 1.73.5 or later, where this vulnerability is patched. Additionally, ensure that the RC server is not exposed without authentication; enable authentication for the RC server if it must be used. If upgrading immediately is not possible, restrict network access to the RC server to trusted hosts only.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-rclone-2026-41179
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-41179"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Critical
Threat ID: 6a4c346f27e9c797196025e2
Added to database: 07/06/2026, 23:04:15 UTC
Last enriched: 09/08/2026, 15:11:25 UTC
Last updated: 09/12/2026, 22:01:33 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.