GO-2026-5466

The operations/fsinfo remote control (RC) endpoint in rclone was registered without requiring authentication. This allowed unauthenticated callers to instantiate arbitrary backends via inline backend definitions, which could lead to local command execution if the backend configuration allows it (e.g., via bearer_token_command in webdav or ssh in sftp).

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-5466"
}

References

Affected packages

Go / github.com/ncw/rclone

Package

Name: github.com/ncw/rclone; View open source insights on deps.dev
Purl: pkg:golang/github.com/ncw/rclone

Affected ranges

Type: SEMVER
Events: Introduced

1.48.0

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/ncw/rclone/fs/operations",
            "symbols": [
                "rcFsInfo"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5466.json"

Go / github.com/rclone/rclone

Package

Name: github.com/rclone/rclone; View open source insights on deps.dev
Purl: pkg:golang/github.com/rclone/rclone

Affected ranges

Type: SEMVER
Events: Introduced

1.49.0

Fixed

1.73.5

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/rclone/rclone/fs/operations",
            "symbols": [
                "ListJSON",
                "rcFsInfo"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5466.json"