CVE-2026-41179criticalCWE-306CWE-78CWE-94

CVE-2026-41179: falha crítica em rclone

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar rclone+ Monitorar rclone

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

63Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 9.2epss 8.6%
da publicação à arma66 dias
Publicada no NVD23 de abr.
1ª PoC+66d
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
rclone · rclone
PoCs públicas encontradas — 1
githubgithub.com/pssec-io/CVE-2026-41179★ 0
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — rclone

No mesmo produto, das mais perigosas para as menos.

CVE-2026-41176CRITICALRclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command executionEPSS 32.7%CVE-2026-49980CRITICALRclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fixEPSS 0.8%CVE-2026-88045HIGHrclone: S3 multipart declared-length memory exhaustionEPSS 0.6%CVE-2026-71310MEDIUMrclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone MemoryEPSS 0.6%CVE-2026-59733HIGHrclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositoriesEPSS 0.6%CVE-2026-88018CRITICALrclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypassEPSS 0.5%