RC
Product
rclone
43
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 5High 11Medium 21Low 6
Watch
Add rclone to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-88018 | 9.8 | Sep 10 | rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass Affected: < 1.75.1 |
| CVE-2026-49980 | 9.8 | Jun 24 | Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix Affected: >= 1.46.0, < 1.74.3 |
| CVE-2026-41179 | 9.8 | Apr 23 | RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution Affected: >= 1.48.0, < 1.73.5 |
| CVE-2026-41176 | 9.8 | Apr 22 | Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution Affected: >= 1.45.0, < 1.73.5 |
| CVE-2026-88044 | 9.1 | Sep 10 | rclone: RC per-server auth-proxy bypass Affected: >= 1.70.0, < 1.75.1 |
Showing 5