CVE-2026-49980
Fixed in a distro release EPSS <1%CVSS 9.8
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.
Products: rclone, Red Hat Cryostat 4, Red Hat OpenShift API for Data Protection, Red Hat Advanced Cluster Management for Kubernetes 2
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/ncw/rclone | no fix |
| Go | github.com/rclone/rclone | 1.74.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | telegraf-1.36 | no fix |
| Chainguard | telegraf-1.37 | no fix |
| Chainguard | telegraf-1.38 | 1.38.4-r19 |
| Chainguard | telegraf-1.39 | 1.39.2-r3 |
| Debian 12 | rclone | no fix |
| Debian 13 | rclone | no fix |
| SUSE Linux Enterprise Server 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 |
| Ubuntu 18.04 LTS | rclone | no fix |
| Ubuntu 22.04 LTS | rclone | 1.53.3-4ubuntu1.22.04.5 |
| Ubuntu 24.04 LTS | rclone | 1.60.1+dfsg-3ubuntu0.24.04.6 |
| Ubuntu 25.10 | rclone | no fix |
| Ubuntu 26.04 LTS | rclone | 1.60.1+dfsg-4ubuntu3.2 |
| Ubuntu 26.10 | rclone | no fix |
| Ubuntu Pro 20.04 LTS | rclone | no fix |
| Wolfi | telegraf-1.36 | no fix |
| Wolfi | telegraf-1.37 | no fix |
| Wolfi | telegraf-1.38 | 1.38.4-r19 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 |
| openSUSE Leap 16.0 | rclone | 1.74.4-bp160.1.1 |
| openSUSE Tumbleweed | rclone | 1.74.3-1.1 |