PT-2026-33833 · Rclone+2 · Rclone+2

0Wnerdied · Published 2026-04-20 · Updated 2026-05-25 · CVE-2026-41179

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rclone versions 1.48.0 through 1.73.4

Description The RC endpoint "operations/fsinfo" is exposed without authentication and accepts attacker-controlled fs input. Since the rc.GetFs() function supports inline backend definitions, an unauthenticated attacker can instantiate a backend on demand. Specifically, for the WebDAV backend, the bearer token command is executed during initialization, allowing for single-request unauthenticated local command execution on reachable RC deployments that lack global HTTP authentication.

Recommendations Update to version 1.73.5. As a temporary workaround, restrict access to the "operations/fsinfo" endpoint or enable global RC HTTP authentication using --rc-user, --rc-pass, or --rc-htpasswd to prevent unauthenticated access.

Exploit

Fix

OS Command Injection

Missing Authentication

Weakness Enumeration

CWE-78

CWE-306

Related Identifiers

BIT-RCLONE-2026-41179

CVE-2026-41179

GHSA-JFWF-28XR-XW6Q

OPENSUSE-SU-2026:10584-1

USN-8299-1

Affected Products

Linuxmint

Rclone

Ubuntu

References · 36

• 🔥 https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41179 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41179 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41179 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41179 · Security Note
• https://ubuntu.com/security/CVE-2026-41179 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jfwf-28xr-xw6q · Vendor Advisory
• https://osv.dev/vulnerability/USN-8299-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41179 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8299-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-rclone-2026-41179 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-GOBINARY-CVE-2026-41179 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10584-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41176 · Vendor Advisory
• https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go · Note