rclone Package Vulnerability: Unauthenticated Command Execution
Reportedly, the rclone package is vulnerable to unauthenticated command execution via the `rclone rcd --rc-serve` command. Versions from 1.55.0 onwards appear to be affected, potentially allowing an unauthenticated network attacker to execute commands as the rclone process user.
What happened
An early warning has been issued regarding a high severity vulnerability in the rclone package. The vulnerability, tracked as CVE-2026-41179 and GHSA-QW24-GH76-8RVV, involves unauthenticated command execution via the `rclone rcd --rc-serve` command. Versions of rclone from 1.55.0 onwards are reportedly affected. This vulnerability could allow an unauthenticated network attacker to execute commands as the rclone process user.
The vulnerability appears to be due to an issue with the remote control API not being properly secured with authentication when using the `rclone rcd --rc-serve` command. The exact details and scope of the vulnerability are under investigation. Professional software engineers using rclone are advised to assess their exposure and consider upgrading to a version of rclone that is not affected by this vulnerability, if available.
For more detailed information, primary sources should be consulted. The recommended action is to upgrade to a secure version of rclone and ensure that the remote control API is properly secured with authentication. Further details and updates can be found in the GitHub Advisory Database under GHSA-qw24-gh76-8rvv.
How 0Day mitigates this
rclone is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.