CVE-2026-41179: Rclone: unauthenticated RC endpoint enables OS command injection via WebDAV backend
Rclone exposes the RC endpoint operations/fsinfo without the AuthRequired flag and accepts attacker-controlled filesystem input. According to the advisory, this can allow single-request local command execution through the WebDAV backend on reachable deployments without global HTTP authentication. The record states that version 1.73.5 fixes the issue.
Overview
Rclone is a command-line tool for syncing files and directories with cloud storage providers. This issue involves the RC endpoint operations/fsinfo, which according to the record is reachable without the AuthRequired flag and accepts attacker-controlled fs input. The vendor advisory is available at GHSA-jfwf-28xr-xw6q.
Impact
- An unauthenticated remote attacker who can reach an RC deployment without global HTTP authentication may be able to make it instantiate an attacker-defined backend.
- For the WebDAV backend, a configuration value is executed as a command during initialization, which the advisory describes as local command execution from a single request.
- The record classifies the weakness as CWE-78 (OS Command Injection). NVD lists a CVSS base score of 9.8 with high confidentiality, integrity and availability impact.
- The record's SSVC data lists technical impact as total.
Affected products and versions
The record places affected Rclone versions from 1.48.0 up to, but not including, 1.73.5. The description states that version 1.73.5 patches the issue. The structured fixes field is empty, so the fixed version is taken from the description text.
Exploitation status
The CISA KEV catalog entry is not listed in this record, so no active exploitation is confirmed by KEV. The SSVC exploitation field is set to 'poc', which indicates proof-of-concept availability as recorded. The EPSS probability is 0.05299 with percentile 0.92561. The reference list includes an entry tagged 'Exploit', but its content is not described in the record. No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Upgrade Rclone to version 1.73.5 or later, as stated in the record.
- Until the upgrade is applied, avoid exposing RC endpoints to untrusted networks and restrict access to trusted administrators.
- Review whether the RC interface is enabled on any host and disable it where it is not needed.
- Consider enabling authentication on the RC interface as an additional control, which is an inference from the description rather than a stated vendor recommendation.
Detection guidance
- Review RC interface logs for requests to operations/fsinfo originating from unexpected sources or accounts.
- Inventory hosts running Rclone with RC enabled and check whether they are reachable from untrusted networks.
- Monitor for unexpected child processes spawned by the Rclone process, which would be consistent with command execution during backend initialization.
Limitations of the available information
The record does not state the exact default configuration, whether RC is enabled by default, or the full set of affected deployment conditions. The structured fixes field is empty, so the fix version relies on the description and the referenced release. The exploitation status is based on the KEV, SSVC and EPSS fields in the record and has not been independently verified.
Frequently asked questions
Which Rclone versions are affected by CVE-2026-41179?
According to the record, versions from 1.48.0 up to, but not including, 1.73.5 are affected.
Is this vulnerability known to be actively exploited?
The record shows the issue is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC field lists exploitation as proof-of-concept.
What should administrators do first?
Upgrade Rclone to 1.73.5 or later, and until then restrict access to RC endpoints from untrusted networks.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.