CVE Intelligence
Analysis AI-assisted

CVE-2026-49980: Rclone rcd --rc-serve: missing authentication enables command execution

Rclone versions from 1.46.0 up to, but not including, 1.74.3 are affected when the rcd --rc-serve service is enabled, because it accepts unauthenticated GET and HEAD requests that can trigger command execution during backend initialization. The record rates the issue critical, with CVSS 3.1 base score 9.8 from the CNA, and states it is fixed in 1.74.3. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Rclone is a command-line tool for syncing files and directories with many cloud storage providers. The record describes a missing authentication issue (CWE-306) in the rcd --rc-serve mode, where unauthenticated GET and HEAD requests can reach backend initialization logic that runs local commands.

Impact

According to the record, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. The CNA CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8. The record also lists a second 3.1 score of 8.1 from another provider, without naming that provider.

Affected products and versions

  • Rclone (listed in the record as Rclone Rclone): versions from 1.46.0 up to, but not including, 1.74.3.
  • Deployments that run the rcd service with --rc-serve.

Exploitation status

The record does not list this CVE in CISA KEV. No confirmed active exploitation appears in the sources consulted. The record contains no EPSS or SSVC data.

Remediation and mitigation

  • Upgrade rclone to version 1.74.3 or later, which the record states is the fixed release.
  • If an upgrade cannot be done immediately, limit network exposure of the rcd remote control service and do not expose it to untrusted networks.
  • Review the vendor advisory linked in the record for the mitigation guidance it provides: GitHub Security Advisory GHSA-qw24-gh76-8rvv.

Detection guidance

  • Inventory all hosts running rclone and record their versions, focusing on those between 1.46.0 and 1.74.3.
  • Review rcd service logs for unauthenticated requests from untrusted sources, particularly requests that do not match expected administrative use.
  • Monitor the rclone process for unexpected child processes or outbound activity, as a high-level indicator of unintended command execution.

Limitations of the available information

The record does not describe the specific backend options involved, the exact conditions under which the issue is reachable, or the identity of the second CVSS provider. The Red Hat references appear in the record, but their contents are not included here, so no details are drawn from them. Whether other maintained branches received backports is unknown from the record.

Frequently asked questions

Which Rclone versions are affected by CVE-2026-49980?

The record lists versions from 1.46.0 up to, but not including, 1.74.3, when the rcd service runs with --rc-serve.

What is the fixed version?

The record states that the vulnerability is fixed in version 1.74.3. Upgrading to that version or later is the remediation the record points to.

Is this CVE known to be actively exploited?

The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.