RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Summary The RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs... supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend,...

EUVD-2026-25144

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution...

GHSA-25QR-6MPR-F7QX Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

Summary The RC endpoint options/set is exposed without AuthRequired: true, but it can mutate global runtime configuration, including the RC option block itself. An unauthenticated attacker can set rc.NoAuth=true, which disables the authorization gate for many RC methods registered with...

EUVD-2026-25142

Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution...

Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

Summary The RC endpoint options/set is exposed without AuthRequired: true, but it can mutate global runtime configuration, including the RC option block itself. An unauthenticated attacker can set rc.NoAuth=true, which disables the authorization gate for many RC methods registered with...

Rclone 访问控制错误漏洞

Rclone is a software developed by the Rclone team that can synchronize data asynchronously from cloud storage. This software supports various cloud storage services such as Google Drive, Amazon Drive, S3, Dropbox, Backblaze B2, One Drive, Swift, Hubic, Cloudfiles, Google Cloud Storage, and Yandex...

PT-2026-33833

Name of the Vulnerable Software and Affected Versions Rclone versions 1.48.0 through 1.73.4 Description The RC endpoint "operations/fsinfo" is exposed without authentication and accepts attacker-controlled fs input. Since the rc.GetFs function supports inline backend definitions, an unauthenticat...

OPENSUSE-SU-2026:10584-1 rclone-1.73.5-1.1 on GA media

These are all security issues fixed in the rclone-1.73.5-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-33832

Name of the Vulnerable Software and Affected Versions Rclone versions 1.45.0 through 1.73.4 Description An authorization bypass exists in the Remote Control RC interface of Rclone. The RC endpoint "options/set" is exposed without requiring authentication, allowing an unauthenticated attacker to...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: multus-cni, vertical-pod-autoscaler, pulumi-language-yaml, cilium-envoy, terraform-provider-sendgrid, redpanda, nri-mssql, db-operator, trillian, oauth2-proxy, dkron, frp, knative-eventing, cilium-cli, aws-privateca-issuer, aws-signer-notation-plugin, seaweedfs,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kyverno, rancher, docker-cli, vexctl, argocd-image-updater, authservice, pulumi-language-yaml, opentofu, cilium-envoy, kubernetes, litestream, terraform-provider-sendgrid, redpanda, kine, opentelemetry-operator, aws-efs-csi-driver, emissary, sftpgo, gitlab-kas,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: multus-cni, vertical-pod-autoscaler, pulumi-language-yaml, cilium-envoy, terraform-provider-sendgrid, redpanda, nri-mssql, db-operator, trillian, oauth2-proxy, dkron, frp, knative-eventing, cilium-cli, aws-privateca-issuer, aws-signer-notation-plugin, seaweedfs,...

GHSA-XMRV-PMRH-HHX2 vulnerabilities

Vulnerabilities for packages: bank-vaults, bento, crossplane-provider-aws-cognitoidentity-fips, crossplane-provider-aws-route53-fips, commercial-chainloop-cli, tflint-fips, crossplane-provider-aws-sns, influxd, chainctl, crossplane-provider-aws-cognitoidp-fips, grafana-mimir-fips,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, prometheus-fips, lazygit, commercial-grafana, grafana-fips, influxd, deck-fips, loki, mcp-grafana-fips, nuclei, grafana-alloy-fips, loki-fips, mcp-grafana, elastic-agent-fips, chainloop-control-plane-fips, deck, weaviate, gitlab-runner-fips,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: kubevela, maru, minio, k8sgpt, redpanda, tempo, mcp-grafana, prometheus, terragrunt, grafana-alloy, nfpm, loki, teleport, vcluster, rclone, dagger, grafana, terraform-mcp-server, nuclei, opentelemetry-collector-contrib, lazygit, gitlab-runner, dgraph, datadog-agent,...

rclone-1.73.3-1.1 on GA media (moderate)

rclone-1.73.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:10419-1 Rating: moderate Cross-References: CVE-2026-33186 CVSS scores: CVE-2026-33186 SUSE : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVE-2026-33186 SUSE : 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N...

OPENSUSE-SU-2026:10419-1 rclone-1.73.3-1.1 on GA media

These are all security issues fixed in the rclone-1.73.3-1.1 package on the GA media of openSUSE Tumbleweed...

rclone-1.73.2-1.1 on GA media (moderate)

rclone-1.73.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:10313-1 Rating: moderate Cross-References: CVE-2026-1229 CVE-2026-27141 CVSS scores: CVE-2026-27141 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-27141 SUSE : 8.7...

OPENSUSE-SU-2026:10313-1 rclone-1.73.2-1.1 on GA media

These are all security issues fixed in the rclone-1.73.2-1.1 package on the GA media of openSUSE Tumbleweed...

rclone-1.73.1-1.1 on GA media (moderate)

rclone-1.73.1-1.1 on GA media Announcement ID: openSUSE-SU-2026:10224-1 Rating: moderate Cross-References: CVE-2025-68121 CVSS scores: CVE-2025-68121 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2025-68121 SUSE : 7.6 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N...