CVE-2026-55183

Deferred Deferred - Pending Action

RClone Manager Unauthenticated API Access Vulnerability

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-55183

EUVD

EUVD-2026-98910

Affected Vendors & Products

Vendor	Product	Version / Range
Zarestia-Dev	rclone-manager	< 0.2.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

CVE-2026-55183 is a critical vulnerability in RClone Manager versions prior to 0.2.7. The application starts the local rclone rcd service on 127.0.0.1:51900 with authentication disabled (--rc-no-auth) and permissive CORS settings (--rc-allow-origin *). This allows any malicious web page visited by a user running RClone Manager to send unauthorized requests to the local API, potentially exposing stored credentials and accessing or modifying files.

Detection Guidance

Check if RClone Manager is running with the vulnerable configuration by inspecting running processes for the rclone rcd service on 127.0.0.1:51900 with flags --rc-no-auth and --rc-allow-origin *. Use commands like 'ps aux | grep rclone' or 'netstat -tulnp | grep 51900' to detect the service.

Impact Analysis

This vulnerability allows attackers to steal stored storage credentials, including secrets and access keys, and access, upload, modify, or exfiltrate files accessible to the user or through configured remotes. There is also a plausible risk of remote code execution, though this remains unconfirmed.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA due to unauthorized access to sensitive data. Under GDPR, unauthorized exposure of personal data (including storage credentials and files) may lead to violations of data protection principles, triggering mandatory breach notifications and potential fines. For HIPAA, the exposure of protected health information (PHI) through compromised credentials or file access could result in violations of the Security Rule, leading to penalties and reputational damage.

Mitigation Strategies

Upgrade RClone Manager to version 0.2.7 or later to address the insecure defaults. If upgrading is not possible, stop the rclone rcd service and avoid using RClone Manager until patched. Review stored credentials for potential exposure.

Hi! I’m here to help you understand CVE-2026-55183. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70