GO-2026-5596

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-5596

Import Source

https://vuln.go.dev/ID/GO-2026-5596.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-5596

Aliases

Related

CGA-vpp4-w684-47mx

Published

2026-08-11T23:21:06Z

Modified

2026-08-14T15:42:04.054189670Z

Summary

Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone

Details

The --rc-serve path in rclone allows unauthenticated remote instantiation, enabling unauthenticated command execution. An attacker can use inline remote backend options such as sftp ssh to run arbitrary commands as the rclone user.

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2026-5596",
    "review_status": "REVIEWED"
}

References

Affected packages

Go / github.com/rclone/rclone

Package

Name: github.com/rclone/rclone; View open source insights on deps.dev
Purl: pkg:golang/github.com/rclone/rclone

Affected ranges

Type: SEMVER
Events: Introduced

1.49.0

Fixed

1.74.3

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/rclone/rclone/fs/rc/rcserver",
            "symbols": [
                "MetricsServer.Serve",
                "MetricsStart",
                "Server.Serve",
                "Server.serveRemote",
                "Start"
            ]
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5596.json"

Go / github.com/ncw/rclone

Package

Name: github.com/ncw/rclone; View open source insights on deps.dev
Purl: pkg:golang/github.com/ncw/rclone

Affected ranges

Type: SEMVER
Events: Introduced

1.46.0

Ecosystem specific

{
    "imports": [
        {
            "symbols": [
                "Server.Serve",
                "Server.serveRemote",
                "Start"
            ],
            "path": "github.com/ncw/rclone/fs/rc/rcserver"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-5596.json"