Critical severity · published Jun 24, 2026
CVE-2026-49980
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RC
rclone · rclone
>= 1.46.0, < 1.74.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49980
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49980
Mitigation
https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-49980
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2492478
Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49980.json
More from rclone
9.8
CVE-2026-88018
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
9.8
CVE-2026-41179
RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
9.8
CVE-2026-41176
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
9.1
CVE-2026-88044
rclone: RC per-server auth-proxy bypass
8.8
CVE-2026-59733
rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories