{"id":"CVE-2026-41179","aliases":["GHSA-jfwf-28xr-xw6q","BIT-rclone-2026-41179","GO-2026-5466"],"title":"RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution","summary":"RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"rclone","product":"github.com/rclone/rclone","ecosystem":"go","affected":["github.com/rclone/rclone >= 1.48.0, < 1.73.5"],"patched":["github.com/rclone/rclone 1.73.5"],"published":"2026-04-22","updated":"2026-08-11","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-jfwf-28xr-xw6q","references":[{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41179"},{"url":"https://github.com/rclone/rclone/commit/2a9e952b38e03a96bf40c9eb6e8e22199865ee3b"},{"url":"https://github.com/rclone/rclone"},{"url":"https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go"},{"url":"https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go"},{"url":"https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go"},{"url":"https://github.com/rclone/rclone/releases/tag/v1.73.5"},{"url":"https://rclone.org/changelog/#v1-73-5-2026-04-19"}],"tags":["osv","go","exploit-available"],"epss":0.08585,"epssPercentile":0.94839,"ingestedAt":"2026-08-12T19:18:08.038Z","exploits":{"github":2,"githubRepos":["https://github.com/pssec-io/CVE-2026-41179","https://github.com/s-vx/CVE-2026-41179"],"nuclei":["CVE-2026-41179"],"checkedAt":"2026-09-24T07:53:03.228Z"},"exploitAvailable":true,"slug":"CVE-2026-41179","body":"## Overview\n\n### Summary\nThe RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication.\n\n### Preconditions\n\nPreconditions for this vulnerability are:\n\n- The rclone remote control API **must** be enabled, either by the `--rc` flag or by running the `rclone rcd` server\n- The remote control API **must** be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use\n- The rc must have been deployed **without** global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc\n\n\n### Details\nThe root cause consists of the following pieces:\n\n1. `operations/fsinfo` is not protected with `AuthRequired: true`\n2. `operations/fsinfo` calls `rc.GetFs(...)` on attacker-controlled input\n3. `rc.GetFs(...)` supports inline backend creation through object-valued `fs`\n4. WebDAV backend initialization executes `bearer_token_command`\n\nRelevant code paths:\n\n- [`fs/operations/rc.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go)\n  - `operations/fsinfo` is registered without `AuthRequired: true`\n  - `rcFsInfo()` calls `rc.GetFs(ctx, in)`\n\n- [`fs/rc/cache.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go)\n  - `GetFs()` / `GetFsNamed()` can parse an object-valued `fs`\n  - `getConfigMap()` converts attacker-controlled JSON into a backend config string\n\n- [`backend/webdav/webdav.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go)\n  - `bearer_token_command` is a supported backend option\n  - `NewFs(...)` calls `fetchAndSetBearerToken()` when `bearer_token_command` is set\n  - `fetchBearerToken()` invokes `exec.Command(...)`\n\nThis creates a practical single-request unauthenticated command-execution primitive on reachable RC servers without global HTTP authentication.\n\nThis was alidated on:\n- current `master` as of 2026-04-14: `bf55d5e6d37fd86164a87782191f9e1ffcaafa82`\n- latest public release tested locally: `v1.73.4`\n\nThis was also validated on a public amd64 Ubuntu host controlled by the tester, using direct host execution (not containerized PoC execution).\n\n### PoC\n#### Minimal single-request form PoC\nStart a vulnerable RC server:\n\n```bash\nrclone rcd --rc-addr 127.0.0.1:5572\n```\n\nNo `--rc-user`, no `--rc-pass`, no `--rc-htpasswd`.\n\nThen send a single request:\n\n```bash\ncurl -sS -X POST http://127.0.0.1:5572/operations/fsinfo \\\n  --data-urlencode \"fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/touch /tmp/rclone_fsinfo_rce_poc_marker':\"\n```\n\nExpected result:\n- HTTP 200 JSON response from `operations/fsinfo`\n- `/tmp/rclone_fsinfo_rce_poc_marker` is created on the host\n\n### Impact\nThis is effectively a single-request unauthenticated command-execution vulnerability on reachable RC deployments without global HTTP authentication.\n\nIn practice, command execution in the rclone process context can lead to higher-impact outcomes such as local file read, file write, or shell access, depending on the deployed environment.\n\n#### Testing performed\nThis was successfully reproduced:\n- on a local test environment\n- on a public amd64 Ubuntu host controlled by the tester\n\nOn the public host it was confirmed:\n\n- the unauthenticated `operations/fsinfo` exploit worked\n- command execution occurred on the host\n- the issue was reproducible through direct host execution\n\n## Affected packages\n\n- `github.com/rclone/rclone >= 1.48.0, < 1.73.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/rclone/rclone 1.73.5`","depth":"abyssal","depthScore":68,"depthScoreParts":{"impact":53.9,"likelihood":1.7,"exploitation":12,"ransomware":0},"changes":[{"seq":5182,"id":"CVE-2026-41179","ts":1788887251967,"field":"exploit_available","old":"false","new":"true"},{"seq":4065,"id":"CVE-2026-41179","ts":1788886367947,"field":"exploit_available","old":"true","new":"false"},{"seq":2854,"id":"CVE-2026-41179","ts":1788883034511,"field":"exploit_available","old":"false","new":"true"},{"seq":1883,"id":"CVE-2026-41179","ts":1788882437427,"field":"exploit_available","old":"true","new":"false"},{"seq":980,"id":"CVE-2026-41179","ts":1788881871950,"field":"exploit_available","old":"false","new":"true"}]}