Loading vulnerability…
Rclone RC options/set Authentication Bypass
CVE-2026-41176 is a missing-authentication vulnerability in Rclone's Remote Control (RC) API. In Rclone versions 1.45.0 through 1.73.4, the options/set RC method was accessible without the AuthRequired protection while retaining the ability to modify global runtime options, including the RC configuration block. An unauthenticated caller can set rc.NoAuth=true, disabling authorization checks for numerous RC methods that are otherwise registered as requiring authentication. Rclone 1.73.5 corrects this behavior.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker can obtain access to protected RC administrative, configuration, and operational functionality. Depending on the RC methods enabled and the runtime configuration, consequences can include disclosure of Rclone configuration and cloud credentials, filesystem enumeration or local file access, modification of runtime settings, and possible command execution.
If you can’t patch tonight, do this now.
Do not expose the Rclone RC API to untrusted networks. Bind RC to localhost where feasible, restrict access with firewall rules or network segmentation, and permit access only from trusted administrative hosts. Enable global RC HTTP authentication, such as with configured RC user/password or htpasswd credentials, until all affected instances are upgraded.
Patch, then assume compromise.
Upgrade Rclone to version 1.73.5 or later. Versions 1.45.0 through 1.73.4 are affected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.