CVE-2026-49980 Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-49980?
CVE-2026-49980 is a critical vulnerability in rclone, published on 24 Jun 2026.
Official description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.
Which versions are affected by CVE-2026-49980?
5 open source packages ship an affected version, including github.com/rclone/rclone, rclone and github.com/ncw/rclone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rclone/rclone Go | From 1.46.0 | 1.74.3 |
github.com/rclone/rclone Go | From 1.46.0 | 1.74.3 |
github.com/rclone/rclone Go | From 1.49.0 | 1.74.3 |
rclone Bitnami | From 1.46.0 | 1.74.3 |
github.com/ncw/rclone Go | From 1.46.0 | None |
Products include Rclone Rclone.
How do I fix CVE-2026-49980?
Upgrade github.com/rclone/rclone to 1.74.3 or later.
Is CVE-2026-49980 being exploited?
There is no known exploitation of CVE-2026-49980 in the wild and no public exploit code.
Other vulnerabilities in rclone
- CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
- CVE-2026-41179 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
- CVE-2026-41176 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
- CVE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories
- CVE-2026-116191 Rclone before 1.75.2 Path Traversal via serve webdav MKCOL
Sources
Also known as BIT-rclone-2026-49980, DEBIAN-CVE-2026-49980, GHSA-qw24-gh76-8rvv, GO-2026-5596, MINI-9g87-6gv6-v4rr, MINI-p32m-rqqr-fgrm and 7 more.