CVE-2026-41176
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.
How to fix
- rclone rclone1.73.5 or later
- github.com/rclone/rclone1.73.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rclone rclone | 1.45 ≤ v < 1.73.5 | 1.73.5 |
| github.com/rclone/rcloneGo | 1.45.0 ≤ v < 1.73.5, v < 1.73.5 | 1.73.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.