BIT-rclone-2026-41176

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/rclone/BIT-rclone-2026-41176.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-rclone-2026-41176
Aliases
Published
2026-04-24T08:51:07.745Z
Modified
2026-04-24T09:56:14.541819984Z
Summary
Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
Details

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint options/set is exposed without AuthRequired: true, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set rc.NoAuth=true, which disables the authorization gate for many RC methods registered with AuthRequired: true on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.

Database specific 
{
    "severity": "Critical",
    "cpes": [
        "cpe:2.3:a:rclone:rclone:*:*:*:*:*:go:*:*"
    ]
}
References

Affected packages

Bitnami / rclone

Package

Name
rclone
Purl
pkg:bitnami/rclone

Severity

  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
1.45.0
Fixed
1.73.5

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/rclone/BIT-rclone-2026-41176.json"