Skip to content
Threat Feed
Subscribe

Vendor

Rclone

3 briefs RSS
critical threat

Rclone Unauthenticated Remote Code Execution Vulnerabilities

Rclone versions prior to 1.73.5 are vulnerable to two critical unauthenticated remote code execution vulnerabilities (CVE-2026-41176 and CVE-2026-41179) when the remote control API is enabled without authentication, potentially allowing attackers to execute arbitrary commands and compromise the system.

exploited Rclone vulnerability rce cloud
2r 2t 2c
critical advisory

Rclone Unauthenticated options/set Allows Runtime Auth Bypass

Rclone is vulnerable to an unauthenticated options/set vulnerability that allows runtime authentication bypass, potentially leading to sensitive operations and command execution by setting `rc.NoAuth=true` on reachable RC servers started without global HTTP authentication.

rclone auth-bypass rc-api CVE-2026-41176 command-execution
2r 3t
medium advisory

Potential Data Exfiltration via Rclone

The rule detects the abuse of rclone, a legitimate file synchronization tool, potentially renamed to evade detection, to exfiltrate data to cloud storage or remote endpoints, using copy/sync commands and specific file filters.

rclone exfiltration cloud storage windows
3r 1t