CVE-2026-49980

When Rclone runs in `rcd --rc-serve` mode, it accepts unauthenticated GET and HEAD requests to paths in the format `/[remote:path]/object`. The `remote` value is retrieved directly from the URL and passed to the backend initialization process. The inline remote configuration mechanism allows embedding backend configuration options directly in the remote resource name — some of these options cause local system commands to be executed during initialization. As a result, an attacker can execute arbitrary commands in the context of the user running the Rclone process without any authentication (CWE-306, CWE-78).

A remote attacker without authentication can execute arbitrary system commands with the privileges of the Rclone process, leading to complete system compromise, data theft, or destruction.

Update Rclone to version 1.74.3 or newer, where the vulnerability has been fixed. Until an update is available, it is recommended to avoid running Rclone with the `rcd --rc-serve` option in network-accessible environments or to protect the rcd interface with authentication mechanisms and restrict access at the firewall level.

Rclone versions 1.46.0 through 1.74.2 (inclusive), running in `rcd --rc-serve` mode