Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rclone rclone
>= 1.48.0, < 1.73.5affected
References
- https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q ↗
- https://github.com/rclone/rclone/commit/2a9e952b38e03a96bf40c9eb6e8e22199865ee3b ↗
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go ↗
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go ↗
- https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go ↗
- https://github.com/rclone/rclone/releases/tag/v1.73.5 ↗
- https://rclone.org/changelog/#v1-73-5-2026-04-19 ↗
- https://access.redhat.com/security/cve/CVE-2026-41179 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2460988 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41179.json ↗