CVE-2026-49980

Critical · CVSS 9.8

rclone — Unauthenticated Remote Command Execution via inline remote configuration (CWE-306, CWE-78)

CVSS: 9.8; nvd
EPSS: 0.75%; 52th pct
KEV: No
Class: oss containerizable; CWE-306, CWE-78

Description

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.

Search profile — drives PoC discovery

Symbols rcd--rc-serve/[remote:path]/objectrc-servebackend initializationinline remote configurationrc-no-authrclone rcd

Keywords CVE-2026-49980rclone rcd rc-serve unauthenticated RCErclone inline remote config command executionGHSA-qw24-gh76-8rvvrclone unauthenticated GET HEAD remote pathrclone rc-serve exploitrclone backend initialization command injectionrclone 1.74.3 patch

Versions: 1.46.0 to 1.74.2

Affected packages

Bitnami	rclone	1.46.0 → 1.74.3
Go	github.com/rclone/rclone	1.46.0 → 1.74.3

References

Status: enriched · ingested 2026-06-29T18:00:49.000Z · profiled 2026-07-01T18:30:14.000Z