Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone
The --rc-serve path in rclone allows unauthenticated remote instantiation, enabling unauthenticated command execution. An attacker can use inline remote backend options such as sftp ssh to run arbitrary commands as the rclone user.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-49980US | —OT erhöht | — | ||
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticate… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/CVE-2026-49980WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2492478WEB
- https://github.com/rclone/rclone/commit/48da1774f4999d1d46543308b9a7fe75585dbfc4FIX
- https://github.com/rclone/rclone/commit/9222ed2c5a7678de7fa620214b0858311c707a29FIX
- https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvvADVISORY
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49980.jsonWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan