Loading story…
Two high-severity vulnerabilities in Rclone expose its remote control (RC) interface to unauthenticated abuse on deployments that do not enforce global HTTP authentication. CVE-2026-41176 affects versions from 1.45.0 through before 1.73.5 and allows attackers to call the options/set endpoint to set rc.NoAuth=true, disabling authorization checks for many RC methods and opening access to sensitive administrative, configuration, and operational functions.
A second flaw, CVE-2026-41179, affects versions from 1.48.0 through before 1.73.5 and stems from the operations/fsinfo endpoint not requiring authentication while accepting attacker-controlled fs input. Because Rclone can instantiate inline backend definitions through rc.GetFs(...), an attacker can create a malicious backend on demand; in the WebDAV backend, the bearer_token_command option is executed during initialization, enabling single-request unauthenticated local command execution. Both issues were patched in Rclone 1.73.5 and were classified under CWE-306, with CVE-2026-41179 also mapped to CWE-78.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
On April 23, 2026, GitHub security advisories disclosed CVE-2026-41176 and CVE-2026-41179 affecting Rclone. The advisories described an unauthenticated auth bypass via `options/set` and unauthenticated local command execution via `operations/fsinfo`, both impacting versions before 1.73.5.
Rclone fixed both vulnerabilities in version 1.73.5, addressing the unauthenticated `options/set` auth bypass and the `operations/fsinfo` backend-instantiation issue that could lead to local command execution. The fixes closed exposure on reachable RC deployments lacking global HTTP authentication.
Rclone version 1.48.0 began exposing the affected `operations/fsinfo` behavior that accepted attacker-controlled `fs` input and allowed backend instantiation. This later became CVE-2026-41179.
Rclone version 1.45.0 introduced the affected behavior behind the RC endpoint `options/set`, allowing runtime changes that could disable authorization checks on deployments without global HTTP authentication. This later became CVE-2026-41176.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
ccb.belgium.be
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **`CVE-2026-71312`** allows command injection in **rclone** versions prior to **`1.75.0`** when the tool interacts with SFTP servers running Windows PowerShell. The flaw stems from improper escaping in rclone's path-handling logic: it escaped only ASCII single quotes, while PowerShell also accepts several Unicode “smart quote” characters as valid string delimiters. A malicious filename on an attacker-controlled or untrusted SFTP path can therefore break out of the intended quoted string and inject arbitrary PowerShell commands. The issue affects server-side hashing and related operations including **`rclone hash`**, **`rclone check`**, and **`rclone sync`**, potentially executing code as the victim SSH account on the remote SFTP server. Public reporting classifies the bug as **`CWE-78`** OS command injection and lists it as remotely exploitable, with a **CVSS v3.1** vector of **`AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`**. rclone addressed the vulnerability in **`1.75.0`** by adding escaping for multiple Unicode smart-quote characters, and users are advised to upgrade and avoid server-side hashing against untrusted SFTP paths.
Aug 6, 2026
dCERT issued two advisories for **Rsync** covering separate vulnerabilities that could expose organizations using the file synchronization tool to attack. One advisory describes an **unspecified attack** path in Rsync, indicating a flaw that could be exploited without public technical detail in the notice, while a second advisory warns that another vulnerability could allow attackers to **bypass security measures**. The paired notices indicate multiple security issues affecting Rsync and raise concern for environments that rely on it for file transfer, backup, or synchronization workflows. Although the advisories provide limited public detail, the combination of an attack-enabling flaw and a security-control bypass suggests defenders should review affected Rsync deployments, monitor for vendor guidance, and prioritize remediation once patches or mitigation steps are confirmed.
Jun 29, 2026
Authorities warned of critical vulnerabilities in two widely used backup and file synchronization products, with the most severe issues enabling remote code execution. In **Veeam Backup & Replication** version `12.3.1.1139` and all earlier `12.x` releases, **CVE-2025-23121** can allow code execution on a backup server when an authenticated domain user account is available, particularly on domain-joined systems. Two additional Veeam flaws, **CVE-2025-24286** and **CVE-2025-24287**, can also lead to arbitrary code execution through backup job modification by an authenticated backup operator or by manipulating local directory contents as a local system user. A separate alert covered **Rsync** version `3.3.0` and earlier, where six server-side vulnerabilities were disclosed. The most critical, **CVE-2024-12084**, can allow arbitrary code execution on a target Rsync server, while additional flaws include **CVE-2024-12085**, **CVE-2024-12747**, **CVE-2024-12086**, **CVE-2024-12087**, and **CVE-2024-12088**; the client application is not affected. Defenders were urged to apply vendor fixes immediately, including upgrading Veeam to version `12.3.2` build `12.3.2.3617` and installing patched Rsync packages provided by Linux distributors.
Jun 29, 2026