ZeroDay Findings
Sign inSign up

Findings

CVE-2026-41179

Rclone is a command-line program to sync files and directories to and from different cloud storage providers.

Published Apr 23, 2026 · updated Jul 15, 2026 · rclone rclone

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint is exposed without and accepts attacker-controlled input. Because supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 23, 2026 · NIST NVD

    Detected

    Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint is exposed without and accepts attacker-controlled input. Because supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, is ex

  2. Jul 15, 2026 · NIST NVD

    Updated

    Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint is exposed without and accepts attacker-controlled input. Because supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, is ex

Affected

  • cpe rclone/rcloneversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-41179

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-41179

    Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint is exposed without and accepts attacker-controlled i

    nvd.nist.gov

References