CVE-2026-55183

Name of the Vulnerable Software and Affected Versions RClone Manager versions prior to 0.2.7

Description RClone Manager starts a local rclone rcd service on 127.0.0.1:51900 using the --rc-no-auth, --rc-allow-origin *, and --rc-serve flags. This configuration allows a malicious web page visited by a user to send cross-origin requests to the unauthenticated local API using the user's operating-system privileges. Such requests can lead to the disclosure of configured storage credentials and enable the unauthorized access, upload, modification, or exfiltration of locally stored files and files on configured remotes.

Recommendations Update to version 0.2.7.