Skip to content
OpenAdvisories

Package · Go

github.com/ncw/rclone

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.8
    CVE-2026-49980

    Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

    Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote…

    rclone rclone rclone rclone Debian Ubuntu Go
  • Critical 9.2
    CVE-2026-41179 Public exploit

    RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

    Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attac…

    rclone rclone rclone rclone Debian Ubuntu Alpine Go