RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Description

A vulnerability identified as critical has been detected in Rclone up to 1.73.4. This affects the function bearer_token_command of the file operations/fsinfo of the component RC Endpoint. The manipulation leads to os command injection. This vulnerability is documented as CVE-2026-41179. The attack can be initiated remotely.

Affected Products

References

• https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q(x_refsource_CONFIRM)
• https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go(x_refsource_MISC)
• https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go(x_refsource_MISC)
• https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go(x_refsource_MISC)

Related News (1 articles)