Compliance Impact

This vulnerability allows unauthenticated remote attackers to bypass authentication on the rclone remote control (RC) interface, leading to unauthorized access to sensitive administrative functions.

Such unauthorized access can result in disclosure of sensitive configuration data, local file reading, filesystem enumeration, and arbitrary command execution.

Because of these impacts, the vulnerability could lead to violations of data protection and privacy regulations such as GDPR and HIPAA, which require strict controls on access to sensitive data and administrative functions.

Organizations using vulnerable versions of rclone without proper RC authentication may fail to meet compliance requirements related to access control, data confidentiality, and integrity.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-41176 is a critical vulnerability in the rclone remote control (RC) API affecting versions from 1.45 up to 1.73.4. The issue arises because the RC endpoint `options/set` is exposed without requiring authentication, allowing unauthenticated attackers to change the global runtime configuration.

An attacker can exploit this by setting `rc.NoAuth=true` via the unauthenticated `options/set` endpoint. This disables the authorization checks for many RC methods that normally require authentication, effectively bypassing the authentication mechanism on RC servers started without global HTTP authentication.

This means that an attacker can gain unauthorized access to sensitive administrative functions, including configuration and operational methods, without needing any credentials.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to disable authentication on the rclone RC server and access sensitive administrative functionality.

• Unauthorized access to configuration methods such as listing remotes, dumping configuration, and getting configuration details.
• Access to operational methods like listing operations, copying files, and executing core commands.
• Potential for arbitrary command execution through methods like `operations/copyfile` which internally use system commands.

Overall, this can lead to local file reading, credential disclosure, filesystem enumeration, and remote command execution, severely compromising the security and integrity of the affected system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the rclone remote control (RC) server is running without authentication and if the `rc.NoAuth` option has been set to true via the unauthenticated `options/set` endpoint.

A practical detection method is to attempt accessing protected RC methods before and after setting `rc.NoAuth=true` to see if authentication is bypassed.

Example commands to detect the vulnerability on a network-accessible rclone RC server (assuming default RC address 127.0.0.1:5572):

• Check if protected methods require authentication (should return HTTP 403 if protected): curl -X POST http://127.0.0.1:5572/config/listremotes
• Attempt to set `rc.NoAuth=true` without authentication: curl -X POST http://127.0.0.1:5572/options/set -H 'Content-Type: application/json' --data '{"rc":{"NoAuth":true}}'
• Re-check protected methods to see if authentication is bypassed (should return HTTP 200 and valid JSON if vulnerable): curl -X POST http://127.0.0.1:5572/config/listremotes

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, ensure that the rclone RC server is started with global HTTP authentication enabled.

Specifically, do not run the RC server without authentication options such as `--rc-user`, `--rc-pass`, or `--rc-htpasswd`.

Additionally, upgrade rclone to version 1.73.5 or later, where this vulnerability has been patched.

• Start the rclone RC server with authentication enabled, for example: rclone rcd --rc-addr 127.0.0.1:5572 --rc-user yourusername --rc-pass yourpassword
• Restrict network access to the RC server to trusted hosts only.
• Upgrade rclone to version 1.73.5 or later.

Useful 0 Not Useful 0