CVE-2026-49980
Publication date 24 June 2026
Last updated 18 September 2026
Ubuntu priority
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| rclone | 26.04 LTS resolute |
Fixed 1.60.1+dfsg-4ubuntu3.2
|
| 24.04 LTS noble |
Fixed 1.60.1+dfsg-3ubuntu0.24.04.6
|
|
| 22.04 LTS jammy |
Fixed 1.53.3-4ubuntu1.22.04.5
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
9.8 · Critical
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8782-1
- Rclone vulnerability
- 18 September 2026