CVE-2026-41176

The record

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.

Affected packages

Related vulnerabilities

• CVE-2026-49980 Rclone is a command-line program to sync files and directories to and from different… Also affects rclone
• CVE-2026-42507 When returning errors, functions in the net/textproto package would include its input as… Also affects rclone
• CVE-2026-42504 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can… Also affects rclone
• CVE-2026-27145 (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all… Also affects rclone
• CVE-2026-44740 Billy is an interface filesystem abstraction for Go. Also affects rclone
• CVE-2026-42500 Decoding a paletted BMP file with an out-of-range palette index results in a panic when… Also affects rclone
• CVE-2026-39824 NewNTUnicodeString does not check for string length overflow. Also affects rclone
• CVE-2026-27136 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects rclone