Summary
It was discovered that Rclone incorrectly handled authorization in the remote
control API. An attacker could possibly use this issue to obtain sensitive
information. (CVE-2026-41176)
It was discovered that Rclone incorrectly handled backend instantiation via the
remote control API. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 24.04 LTS, Ubuntu 25.10 and
Ubuntu 26.04 LTS. (CVE-2026-41179)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | rclone | 1.53.3-4ubuntu1.22.04.4 |
| Ubuntu · 24.04 LTS 24.04:LTS | rclone | 1.60.1+dfsg-3ubuntu0.24.04.5 |
| Ubuntu · 25.10 | rclone | 1.60.1+dfsg-4ubuntu2.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | rclone | 1.60.1+dfsg-4ubuntu3.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | rclone | 1.50.2-2ubuntu0.2+esm1 |