CVE-2026-41179: Rclone RC Endpoint RCE Vulnerability

CVE-2026-41179 Overview

CVE-2026-41179 is a critical command injection vulnerability in Rclone, a widely-used command-line program for synchronizing files and directories across different cloud storage providers. The vulnerability affects the Remote Control (RC) endpoint operations/fsinfo, which is exposed without proper authentication requirements.

Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint accepts attacker-controlled fs input without requiring authentication. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. When targeting the WebDAV backend specifically, the bearer_token_command parameter is executed during backend initialization, enabling single-request unauthenticated local command execution on reachable RC deployments that lack global HTTP authentication.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary command execution on systems running vulnerable Rclone RC deployments without global HTTP authentication configured.

Affected Products

• Rclone versions 1.48.0 through 1.73.4
• Systems with exposed RC endpoints without global HTTP authentication
• Deployments using the WebDAV backend configuration

Discovery Timeline

• April 23, 2026 - CVE-2026-41179 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-41179

Vulnerability Analysis

This vulnerability represents a classic CWE-78 (OS Command Injection) flaw stemming from insufficient access control on a sensitive API endpoint. The RC (Remote Control) interface in Rclone provides programmatic access to various file system operations, and the operations/fsinfo endpoint was inadvertently exposed without the AuthRequired: true flag.

The core issue lies in how Rclone's filesystem initialization handles inline backend definitions. When an attacker crafts a malicious request targeting the operations/fsinfo endpoint with a specially crafted fs parameter, the rc.GetFs(...) function processes this input and attempts to instantiate the specified backend. For WebDAV backends, the bearer_token_command option specifies an external command to retrieve authentication tokens—a legitimate feature that becomes dangerous when controlled by an attacker.

This vulnerability enables network-based attacks with no user interaction required, allowing complete system compromise through arbitrary command execution in the context of the Rclone process.

Root Cause

The root cause of CVE-2026-41179 is the missing authentication requirement on the operations/fsinfo RC endpoint combined with the powerful inline backend definition feature. The endpoint was registered without AuthRequired: true, allowing unauthenticated access to functionality that can trigger command execution through backend initialization.

The WebDAV backend's bearer_token_command feature, designed for legitimate authentication token retrieval, becomes an exploitation vector when an attacker can control the backend configuration through the unauthenticated endpoint.

Attack Vector

The attack exploits the network-accessible RC interface through a single HTTP request. An attacker sends a crafted POST request to the operations/fsinfo endpoint with a malicious fs parameter that defines an inline WebDAV backend configuration. This configuration includes a bearer_token_command set to the attacker's desired command.

When Rclone processes this request:

1. The rc.GetFs(...) function parses the inline backend definition
2. A new WebDAV backend instance is created with the attacker-specified configuration
3. During backend initialization, bearer_token_command is executed
4. The attacker's command runs with the privileges of the Rclone process

The attack requires no prior authentication and can be executed with a single HTTP request against any exposed RC endpoint lacking global HTTP authentication. Technical implementation details can be found in the GitHub Security Advisory GHSA-jfwf-28xr-xw6q and the relevant source files including rc.go and webdav.go.

Detection Methods for CVE-2026-41179

Indicators of Compromise

• Unexpected HTTP POST requests to /operations/fsinfo endpoint from external IP addresses
• Rclone RC access logs showing requests with inline WebDAV backend definitions containing bearer_token_command
• Unusual child processes spawned by the Rclone process
• Suspicious command executions in the context of the user running Rclone

Detection Strategies

• Monitor network traffic for HTTP POST requests to Rclone RC endpoints (/operations/fsinfo) from untrusted sources
• Implement log analysis rules to detect requests containing webdav backend strings with bearer_token_command parameters
• Deploy endpoint detection rules for unusual process trees originating from Rclone processes
• Use SentinelOne's behavioral AI to detect command injection patterns and unexpected command execution

Monitoring Recommendations

• Enable verbose logging on Rclone RC deployments to capture all incoming requests
• Configure SIEM alerts for access to sensitive RC endpoints from external networks
• Monitor system call activity for Rclone processes using EDR solutions
• Implement network segmentation to restrict RC endpoint access to authorized internal systems only

How to Mitigate CVE-2026-41179

Immediate Actions Required

• Upgrade Rclone to version 1.73.5 or later immediately
• If immediate patching is not possible, enable global HTTP authentication on all RC deployments using --rc-user and --rc-pass flags
• Restrict network access to RC endpoints using firewall rules
• Audit existing Rclone deployments for exposure to untrusted networks

Patch Information

The vulnerability is patched in Rclone version 1.73.5. The fix adds proper authentication requirements to the operations/fsinfo endpoint by including AuthRequired: true in the endpoint registration. Organizations should upgrade to version 1.73.5 or later to remediate this vulnerability. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Enable HTTP authentication on the RC interface with --rc-user=<username> --rc-pass=<password> flags
• Bind the RC interface to localhost only using --rc-addr=127.0.0.1:5572 if remote access is not required
• Implement network-level access controls to restrict RC endpoint access to trusted IP addresses
• Consider disabling the RC interface entirely if not actively required for operations

# Secure Rclone RC configuration example
# Enable authentication and bind to localhost only
rclone rcd --rc-addr=127.0.0.1:5572 --rc-user=admin --rc-pass=StrongPassword123!

# Alternative: Use HTTPS with authentication
rclone rcd --rc-addr=:5572 --rc-user=admin --rc-pass=StrongPassword123! --rc-cert=/path/to/cert.pem --rc-key=/path/to/key.pem