Homepage

Missing Authentication for Critical Function Affecting rclone package, versions <1.60.1+dfsg-4ubuntu3.2

Severity

 Recommended
medium

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.78% (55th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2604-RCLONE-17486825
  • published19 Sept 2026
  • disclosed24 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 24 Jun 2026

CVE-2026-49980  (opens in a new tab)
CWE-306  (opens in a new tab)

How to fix?

Upgrade Ubuntu:26.04 rclone to version 1.60.1+dfsg-4ubuntu3.2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rclone package and not the rclone package as distributed by Ubuntu. See How to fix? for Ubuntu:26.04 relevant fixed versions and status.

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.