Missing Authentication for Critical Function in rclone - CVE-2026-41176

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass authorization and access sensitive administrative functionality, potentially leading to command execution.

The vulnerability exists due to missing authentication for the options/set RC endpoint in the rclone remote control API when handling unauthenticated requests that modify runtime configuration. A remote attacker can send a specially crafted request to disable the authorization gate for protected RC methods to bypass authorization and access sensitive administrative functionality, potentially leading to command execution.

Exploitation requires the remote control API to be enabled, reachable by the attacker, and deployed without global RC HTTP authentication.

How to mitigate CVE-2026-41176

Sources

• https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx