CVE-2026-49980: Rclone Command-Line RCE Vulnerability

CVE-2026-49980 Overview

CVE-2026-49980 is a missing authentication vulnerability [CWE-306] in rclone, the command-line tool for syncing files across cloud storage providers. The flaw affects rclone versions 1.46.0 through 1.74.2 when run with rclone rcd --rc-serve. The remote control HTTP server accepts unauthenticated GET and HEAD requests to paths matching /[remote:path]/object. Because the remote value is parsed from the URL and passed to backend initialization, inline remote configuration can set backend options that execute local commands. A single unauthenticated HTTP request can execute arbitrary commands as the rclone process user. The issue is fixed in 1.74.3.

Critical Impact
An unauthenticated network attacker can achieve remote code execution on any host running rclone rcd --rc-serve simply by sending one crafted GET or HEAD request.

Affected Products

rclone 1.46.0 through 1.74.2 running rcd --rc-serve
All operating systems supported by rclone (Linux, macOS, Windows, BSD)
Any service or container exposing the rclone remote control HTTP endpoint

Discovery Timeline

2026-06-24 - CVE-2026-49980 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-49980

Vulnerability Analysis

Rclone exposes a remote control server via the rcd subcommand. The --rc-serve option additionally allows clients to fetch objects from configured remotes by issuing HTTP requests of the form /[remote:path]/object. The handler parses the remote segment directly from the URL and forwards it into the standard backend initialization pipeline used for normal CLI invocation.

That initialization pipeline supports inline configuration syntax, allowing backend options to be specified as part of the remote string. Several rclone backends accept options that invoke local commands during setup, including options that resolve credentials or transform paths through external programs. Because the URL handler does not require authentication and does not constrain the remote syntax to pre-configured names, an attacker controls the full backend specification.

Root Cause

The root cause is missing authentication on a code path that performs sensitive operations. The --rc-serve object handler bypasses the standard rc authentication checks for GET and HEAD methods. Combined with the design choice to parse remote configuration inline from user-supplied input, this turns a read-only file fetch endpoint into an arbitrary command execution primitive.

Attack Vector

The attack vector is network-accessible and requires no privileges or user interaction. An attacker locates an rclone instance running rcd --rc-serve and issues a single HTTP GET or HEAD request. The URL embeds an inline remote definition whose backend options trigger execution of a shell command. The command runs in the security context of the rclone process user. See the GitHub Security Advisory GHSA-qw24-gh76-8rvv for technical specifics and reproduction details.

Detection Methods for CVE-2026-49980

Indicators of Compromise

HTTP access logs containing requests to paths of the form /[remote:path]/object where the remote segment contains backend option syntax such as , separators or command-invoking options.
Child processes spawned by the rclone binary that do not correspond to legitimate backend helpers, such as /bin/sh, bash, cmd.exe, or powershell.exe.
Outbound network connections initiated by the rclone process to unexpected destinations following an inbound request to the rc HTTP port.

Detection Strategies

Inspect rclone HTTP access logs for requests whose path contains URL-encoded colons, commas, or known backend option keywords inside the remote segment.
Monitor process telemetry for unexpected child processes parented to rclone, especially shell interpreters or interpreters launched on hosts where rclone normally runs unattended.
Alert on rclone listening on network interfaces other than localhost when --rc-serve is in use.

Monitoring Recommendations

Forward rclone stdout, stderr, and any reverse-proxy access logs to a central log platform and retain for at least 90 days.
Baseline normal rclone process trees and network destinations, then alert on deviations.
Track installed rclone versions across the fleet and flag any host running a version earlier than 1.74.3.

How to Mitigate CVE-2026-49980

Immediate Actions Required

Upgrade rclone to version 1.74.3 or later on every host that runs rcd --rc-serve.
Until patched, stop or restart any rclone rcd --rc-serve process and remove the --rc-serve flag from service definitions.
Block external network access to the rclone remote control port at the host firewall and at perimeter controls.
Audit historical access logs and process telemetry on exposed hosts for signs of exploitation.

Patch Information

The rclone maintainers fixed the vulnerability in version 1.74.3. The fix is documented in the rclone GitHub Security Advisory GHSA-qw24-gh76-8rvv. Upgrade by replacing the binary with the official 1.74.3 release and restarting any services that invoke rclone rcd.

Workarounds

Run rclone under a dedicated, unprivileged service account with no shell and minimal filesystem access to limit the blast radius of successful exploitation.
Bind the rc server to 127.0.0.1 using --rc-addr 127.0.0.1:5572 and require a reverse proxy that enforces authentication.
Disable --rc-serve entirely and use the authenticated rc API surface instead, with --rc-user and --rc-pass configured.
Apply network segmentation so the rclone host cannot reach sensitive internal services if compromised.

bash

# Example hardened invocation pending upgrade
rclone rcd \
  --rc-addr 127.0.0.1:5572 \
  --rc-user admin \
  --rc-pass "$(cat /etc/rclone/rc.pass)" \
  --rc-serve=false