CVE-2026-49980

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49980
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-49980.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-49980
Aliases
Downstream
Related
Published
2026-06-24T17:52:33.024Z
Modified
2026-06-28T04:03:51.288648939Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
Details

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49980.json",
    "cwe_ids": [
        "CWE-306"
    ]
}
References

Affected packages

Git / github.com/rclone/rclone

Affected ranges

Type
GIT
Repo
https://github.com/rclone/rclone
Events
Introduced
eb85ecc9c480175bd39a2009212ffa81eaebee7c
Fixed
37e4117f48bdef0fa1ba27f6467d7a891b0b55ba
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "1.46.0"
        },
        {
            "fixed": "1.74.3"
        }
    ]
}

Affected versions

v1.*
v1.46
v1.46.0
v1.47.0
v1.48.0
v1.49.0
v1.50.0
v1.51.0
v1.52.0
v1.53.0
v1.54.0
v1.55.0
v1.56.0
v1.57.0
v1.58.0
v1.59.0
v1.60.0
v1.61.0
v1.62.0
v1.63.0
v1.64.0
v1.65.0
v1.66.0
v1.67.0
v1.68.0
v1.69.0
v1.70.0
v1.71.0
v1.72.0
v1.73.0
v1.74.0
v1.74.1
v1.74.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-49980.json"