https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 13:55:26 +0000 https://db.gcve.eu/vuln/cve-2026-41176 <p><strong>Affected:</strong> rclone, Red Hat OpenShift API for Data Protection, Red Hat Advanced Cluster Management for Kubernetes 2</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.</p> <p><strong>Affected:</strong> rclone, Red Hat OpenShift API for Data Protection, Red Hat Advanced Cluster Management for Kubernetes 2</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.</p> https://db.gcve.eu/vuln/cve-2026-41176 https://db.gcve.eu/vuln/ghsa-25qr-6mpr-f7qx <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>### Summary The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. An unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods.</p> <p>### Preconditions</p> <p>Preconditions for this vulnerability are:</p> <p>- The rclone remote control API **must** be enabled, either by the `--rc` flag or by running the `rclone rcd` server - The remote control API **must** be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use - The rc must have been deployed **without** global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc</p> <p>### Details The root cause is present from v1.45 onward. Some higher-impact exploitation paths became available in later releases as additional RC functionality was introduced.</p> <p>The issue is caused by two properties of the RC implementation:</p> <p>1. `options/set` is exposed without `AuthRequired: true` 2. the RC server enforces authorization for `AuthRequired` calls using the mutable runtime value `s.opt.NoAuth`</p> <p>Relevant code paths:</p> <p>- [`fs/rc/config.go`](https://github.com/rclone/rclone/blob/bf55d5e6d…</p> <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>### Summary The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. An unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods.</p> <p>### Preconditions</p> <p>Preconditions for this vulnerability are:</p> <p>- The rclone remote control API **must** be enabled, either by the `--rc` flag or by running the `rclone rcd` server - The remote control API **must** be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use - The rc must have been deployed **without** global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc</p> <p>### Details The root cause is present from v1.45 onward. Some higher-impact exploitation paths became available in later releases as additional RC functionality was introduced.</p> <p>The issue is caused by two properties of the RC implementation:</p> <p>1. `options/set` is exposed without `AuthRequired: true` 2. the RC server enforces authorization for `AuthRequired` calls using the mutable runtime value `s.opt.NoAuth`</p> <p>Relevant code paths:</p> <p>- [`fs/rc/config.go`](https://github.com/rclone/rclone/blob/bf55d5e6d…</p> https://db.gcve.eu/vuln/ghsa-25qr-6mpr-f7qx