CVE-2026-49980

Name of the Vulnerable Software and Affected Versions rclone versions 1.46.0 through 1.74.2

Description When the remote control API is enabled and the --rc-serve flag is used without HTTP authentication, the software accepts unauthenticated GET and HEAD requests to paths formatted as '/[remote:path]/object'. The remote value is parsed from the URL and passed to backend initialization. In versions 1.55.0 and later, inline remote configuration allows setting backend options that can execute local commands as the rclone process user. In versions 1.46.0 through 1.54.x, this mechanism allows for unauthenticated local file reads. Additionally, inline global.* options can mutate process-wide configuration, such as global.http proxy. This issue can be triggered by network attackers or via browser subresource requests against a localhost-only listener.

Recommendations Update to version 1.74.3. Configure HTTP authentication using --rc-user, --rc-pass, or --rc-htpasswd. Disable the --rc-serve flag if file serving is not required.