BIT-rclone-2026-41179: RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.
AI Analysis
Technical Summary
Rclone's RC endpoint operations/fsinfo is exposed without authentication in versions >=1.48.0 <1.73.5. The endpoint accepts attacker-controlled fs input, and because rc.GetFs supports inline backend definitions, an attacker can instantiate arbitrary backends. For the WebDAV backend, the bearer_token_command is executed during backend initialization, enabling unauthenticated local command execution. This vulnerability allows an attacker to execute local commands on the host running the Rclone RC service without authentication. The vulnerability is fixed in version 1.73.5.
Potential Impact
An unauthenticated attacker can execute arbitrary local commands on systems running vulnerable Rclone RC endpoints. This can lead to full system compromise depending on the privileges of the Rclone process. The vulnerability affects deployments where the RC endpoint is reachable and not protected by global HTTP authentication.
Mitigation Recommendations
Upgrade Rclone to version 1.73.5 or later, where this vulnerability is patched. Until upgrading, ensure that the RC endpoint is not exposed to untrusted networks and is protected by authentication mechanisms. Patch status is confirmed fixed in version 1.73.5.
BIT-rclone-2026-41179: RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Rclone's RC endpoint operations/fsinfo is exposed without authentication in versions >=1.48.0 <1.73.5. The endpoint accepts attacker-controlled fs input, and because rc.GetFs supports inline backend definitions, an attacker can instantiate arbitrary backends. For the WebDAV backend, the bearer_token_command is executed during backend initialization, enabling unauthenticated local command execution. This vulnerability allows an attacker to execute local commands on the host running the Rclone RC service without authentication. The vulnerability is fixed in version 1.73.5.
Potential Impact
An unauthenticated attacker can execute arbitrary local commands on systems running vulnerable Rclone RC endpoints. This can lead to full system compromise depending on the privileges of the Rclone process. The vulnerability affects deployments where the RC endpoint is reachable and not protected by global HTTP authentication.
Mitigation Recommendations
Upgrade Rclone to version 1.73.5 or later, where this vulnerability is patched. Until upgrading, ensure that the RC endpoint is not exposed to untrusted networks and is protected by authentication mechanisms. Patch status is confirmed fixed in version 1.73.5.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-rclone-2026-41179
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-41179"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Critical
- Cvss Version
- null
Threat ID: 6a4c346f27e9c797196025e2
Added to database: 07/06/2026, 23:04:15 UTC
Last enriched: 07/06/2026, 23:35:55 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.