CVE-2026-41176

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41176
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41176.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41176
Aliases
Downstream
Related
Published
2026-04-22T23:57:54.075Z
Modified
2026-07-31T18:31:44.320292999Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
Details

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint options/set is exposed without AuthRequired: true, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set rc.NoAuth=true, which disables the authorization gate for many RC methods registered with AuthRequired: true on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41176.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/rclone/rclone

Affected ranges

Type
GIT
Repo
https://github.com/rclone/rclone
Events
Introduced
d35bd15762f8f0f365fd3e1784e93add3bbdc61c
Fixed
2c12ca64d451d79252982fcf96b09dff1d55b55e
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.45.0"
        },
        {
            "fixed": "1.73.5"
        },
        {
            "introduced": "1.45"
        }
    ]
}

Affected versions

v1.*
v1.45
v1.46
v1.46.0
v1.47.0
v1.48.0
v1.49.0
v1.50.0
v1.51.0
v1.52.0
v1.53.0
v1.54.0
v1.55.0
v1.56.0
v1.57.0
v1.58.0
v1.59.0
v1.60.0
v1.61.0
v1.62.0
v1.63.0
v1.64.0
v1.65.0
v1.66.0
v1.67.0
v1.68.0
v1.69.0
v1.70.0
v1.71.0
v1.72.0
v1.73.0
v1.73.1
v1.73.2
v1.73.3
v1.73.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41176.json"