PT-2026-47184 · Rclone · Rclone
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
rclone versions 1.46.0 through 1.74.2
Description
When the remote control API is enabled and the
--rc-serve flag is used without HTTP authentication, the software accepts unauthenticated GET and HEAD requests to paths formatted as '/[remote:path]/object'. The remote value is parsed from the URL and passed to backend initialization. In versions 1.55.0 and later, inline remote configuration allows setting backend options that can execute local commands as the rclone process user. In versions 1.46.0 through 1.54.x, this mechanism allows for unauthenticated local file reads. Additionally, inline global.* options can mutate process-wide configuration, such as global.http proxy. This issue can be triggered by network attackers or via browser subresource requests against a localhost-only listener.Recommendations
Update to version 1.74.3.
Configure HTTP authentication using
--rc-user, --rc-pass, or --rc-htpasswd.
Disable the --rc-serve flag if file serving is not required.Exploit
Fix
Missing Authentication
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Rclone