Command-line Program Vulnerability in Rclone Exposes Sensitive Configurations
CVE-2026-41176

9.2CRITICAL

Key Information:

Vendor

Rclone

Status
Rclone
Vendor
CVE Published:
22 April 2026

What is CVE-2026-41176?

Rclone, the command-line tool designed for syncing files across various cloud storage services, possesses a vulnerability that allows unauthenticated attackers to manipulate the global runtime configuration. The RC endpoint options/set is not secured with the necessary authentication, enabling attackers to disable critical authorization features (rc.NoAuth=true). This oversight could lead to the exposure of sensitive administrative functions, allowing unauthorized changes to operational methods. Users are urged to update to version 1.73.5 or later to mitigate this risk.

Affected Version(s)

rclone >= 1.45.0, < 1.73.5

References

https://github.com/rclone/rclone/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a...
x_refsource_MISC
https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a...
x_refsource_MISC

EPSS Score

34% chance of being exploited in the next 30 days.

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.