https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 12 Nov 2026 04:15:58 +0000 https://db.gcve.eu/vuln/cve-2026-49980 <p><strong>Affected:</strong> rclone, Red Hat Cryostat 4, Red Hat OpenShift API for Data Protection, Red Hat Advanced Cluster Management for Kubernetes 2</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.</p> <p><strong>Affected:</strong> rclone, Red Hat Cryostat 4, Red Hat OpenShift API for Data Protection, Red Hat Advanced Cluster Management for Kubernetes 2</p> <p>Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.</p> https://db.gcve.eu/vuln/cve-2026-49980 https://db.gcve.eu/vuln/ghsa-qw24-gh76-8rvv <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>## Summary</p> <p>`rclone rcd --rc-serve` accepts unauthenticated `GET` and `HEAD` requests to paths of the form:</p> <p>```text /[remote:path]/object ```</p> <p>The `remote` value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated `GET` or `HEAD` request can execute a command as the rclone process user.</p> <p>Versions from 1.55.0 onwards are vulnerable to command execution. Earlier versions (from 1.46.0) are vulnerable to the unauthenticated local file read described under &#34;Additional impact&#34; but not to command execution, because inline backend option overrides did not exist until 1.55.0.</p> <p>## Preconditions</p> <p>Preconditions for this vulnerability are:</p> <p>- The rclone remote control API must be enabled, either by the `--rc` flag or by running the `rclone rcd` server - The remote control API must be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use - The rc must have been deployed without global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc - The `--rc-serve` flag must be in use</p> <p>## Impact</p> <p>An unauthenticated network attacker who can reach the RC HTTP listener can execute commands as the rclone process user.</p> <p>Additional impact observed during testing:</p> <p>- `GET` and `HEAD` both trigger backend initialization. - The same path allows unauthenticated lo…</p> <p><strong>Affected:</strong> Go: github.com/rclone/rclone</p> <p>## Summary</p> <p>`rclone rcd --rc-serve` accepts unauthenticated `GET` and `HEAD` requests to paths of the form:</p> <p>```text /[remote:path]/object ```</p> <p>The `remote` value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated `GET` or `HEAD` request can execute a command as the rclone process user.</p> <p>Versions from 1.55.0 onwards are vulnerable to command execution. Earlier versions (from 1.46.0) are vulnerable to the unauthenticated local file read described under &#34;Additional impact&#34; but not to command execution, because inline backend option overrides did not exist until 1.55.0.</p> <p>## Preconditions</p> <p>Preconditions for this vulnerability are:</p> <p>- The rclone remote control API must be enabled, either by the `--rc` flag or by running the `rclone rcd` server - The remote control API must be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use - The rc must have been deployed without global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc - The `--rc-serve` flag must be in use</p> <p>## Impact</p> <p>An unauthenticated network attacker who can reach the RC HTTP listener can execute commands as the rclone process user.</p> <p>Additional impact observed during testing:</p> <p>- `GET` and `HEAD` both trigger backend initialization. - The same path allows unauthenticated lo…</p> https://db.gcve.eu/vuln/ghsa-qw24-gh76-8rvv