Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rclone | rclone | >= 1.45.0, < 1.73.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | rclone | No fix yet | — |
| Debian 12 | rclone | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rclone | No fix yet | — |
| Ubuntu 26.04 LTS | rclone | 1.60.1+dfsg-4ubuntu3.1 | — |
| Ubuntu 25.10 | rclone | 1.60.1+dfsg-4ubuntu2.1 | — |
| Ubuntu 24.04 LTS | rclone | 1.60.1+dfsg-3ubuntu0.24.04.5 | — |
| Ubuntu 22.04 LTS | rclone | 1.53.3-4ubuntu1.22.04.4 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | rclone | 1.50.2-2ubuntu0.2+esm1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rclone | 1.73.5-1.1 | openSUSE-SU-2026:10584-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 16.0 | rclone | 1.74.4-bp160.1.1 | openSUSE-SU-2026:21436-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | rclone | 1.73.5-75.amzn2023 | ALAS2023-2026-1658 |
| Amazon Linux 2 | rclone | 1.55.1-1.amzn2.0.5 | ALAS2-2026-3285 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | telegraf-1.38 | 1.38.4-r19 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Rclone RC - Broken Access Control http/cves/2026/CVE-2026-41176.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/rclone/rclone | >= 1.45.0, < 1.73.5 | 1.73.5 | GHSA-25qr-6mpr-f7qx |
| Go | github.com/rclone/rclone | < 1.73.5 | 1.73.5 | GO-2026-4964 |
Advisories 6
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- openSUSE-SU-2026:21436-1 Security update for rclone SUSE / openSUSE Security Updates · Jul 24, 2026
- WID-SEC-2026-1179 rclone: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 14, 2026
- ALAS2-2026-3285 Important: rclone security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 13, 2026
- ALAS2023-2026-1658 Important: rclone security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
- openSUSE-SU-2026:10584-1 rclone-1.73.5-1.1 on GA media SUSE / openSUSE Security Updates · Apr 21, 2026