Skip to content
OpenAdvisories
Critical USN-8782-1 1 CVE

rclone vulnerability

Published Sep 18, 2026 · Updated Sep 18, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Rclone incorrectly handled unauthenticated requests
to the remote control API. An attacker could possibly use this issue to
execute arbitrary commands as the user invoking rclone. (CVE-2026-49980)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS rclone 1.53.3-4ubuntu1.22.04.5
Ubuntu · 24.04 LTS 24.04:LTS rclone 1.60.1+dfsg-3ubuntu0.24.04.6
Ubuntu · 26.04 LTS 26.04:LTS rclone 1.60.1+dfsg-4ubuntu3.2

Vulnerabilities 1

  • Critical 9.8
    CVE-2026-49980

    Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

    Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote…

    rclone rclone telegraf-1.38 rclone Debian Ubuntu Wolfi Go

References

  • report
    https://ubuntu.com/security/CVE-2026-49980