Database/Control plane, storage & DevOps

rclone (rcd remote control server): An unauthenticated request to the rclone remote-control server instantiates a

CVSS 9.8CVE-2026-49980Control plane, storage & DevOpscurated

Impact

An unauthenticated request to the rclone remote-control server instantiates a backend defined inline in the request, and some backend options run commands. That is unauthenticated arbitrary command execution as whatever user rclone runs as - typically the data-mover service account holding credentials to every storage system it touches.

Who can reach it

Anyone who can reach the rclone rcd HTTP port. Data movers are commonly run on a shared node with the port bound broadly, so a tenant on the same network is enough.

What to do

Upgrade rclone to the fixed release and restart every rcd/serve instance. Treat any exposed instance as compromised and rotate all remote credentials in its config. Bind rcd to loopback, require --rc-user/--rc-pass, and never expose it on a tenant-reachable interface.

References

https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv https://nvd.nist.gov/vuln/detail/CVE-2026-49980

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.