CVE-2026-41179

The RC endpoint `operations/fsinfo` does not have the `AuthRequired: true` flag set, making it accessible without authentication. It accepts an attacker-controlled `fs` parameter, and the `rc.GetFs(...)` mechanism supports inline backend definitions, allowing dynamic creation of backends as desired by the attacker. When the attacker specifies a WebDAV backend, the `bearer_token_command` option is executed by the operating system during backend initialization—before any user identity verification. As a result, a single HTTP request to an accessible RC instance is sufficient to execute any local command on the server.

An unauthenticated attacker can execute arbitrary system commands in the context of the Rclone process running on the server, leading to complete system takeover, data theft, or further lateral movement in the network.

Rclone should be updated to version 1.73.5, which patches the described vulnerability. Until the update is applied, it is recommended to disable the RC interface or secure it with global HTTP authentication and restrict access to the RC endpoint using a firewall to trusted IP addresses.

Rclone versions 1.48.0 to 1.73.4 inclusive, with the RC (Remote Control) interface enabled without global HTTP authentication.