$ cve CVE-2026-41179 JSON

CVE-2026-41179

9.8

CRITICAL · CVSS 3.1 · EPSS 5.3% (pctl 92)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	5.3% — more likely to be exploited than 92% of all CVEs
Weakness	CWE-78
On CISA KEV	no
Public exploit	none known
Published	2026-04-23
Last modified	2026-07-15

Affected (1)

Vendor	Product
rclone	rclone

References

→ the Explorer · watch your stack · NVD