CVE-2026-41176Critical· 9.8▾ AbyssalPoC availableRclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, includin…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 6.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
33%
Nuclei ×1 (last check)
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint options/set is exposed without AuthRequired: true, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set rc.NoAuth=true, which disables the authorization gate for many RC methods registered with AuthRequired: true on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.
rclone >= 1.45, < 1.73.5Upgrade past the affected range:
rclone 1.73.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88018Critical· 9.8rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-93987Low· 3.4rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin
CVE-2026-79776Medium· 5.3rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler
CVE-2026-88044Critical· 9.1rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88015Medium· 5.3rclone is a command-line program to sync files and directories to and from different cloud storage providers
CVE-2026-88013Low· 3.7rclone is a command-line program to sync files and directories to and from different cloud storage providers