rclone (rc API, options/set): options/set is exposed pre-authentication and can rewrite the running instance's auth

Impact

options/set is exposed pre-authentication and can rewrite the running instance's auth settings, so an attacker first turns the remaining protections off and then drives the rest of the rc API - up to command execution. One unauthenticated call converts a partly-protected data mover into a fully open one.

Who can reach it

Any host with network reach to the rclone rc endpoint.

What to do

Upgrade rclone and restart every rc/serve process. Rotate remote credentials for exposed instances. Bind the rc listener to loopback and put it behind an authenticating proxy rather than relying on rclone's own flags alone.

References