{"items":[{"id":"NVI-00018641","kind":"vulnerability","title":"RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jfwf-28xr-xw6q","CVE-2026-41179"],"plain_summary":"GitHub lists this reviewed advisory for github.com/rclone/rclone. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-49efaad02dc51d131287201acc8cc23a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-05-20T01:36:08.000Z","value":"9.8 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-49efaad02dc51d131287201acc8cc23a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-49efaad02dc51d131287201acc8cc23a","url":"https://github.com/advisories/GHSA-jfwf-28xr-xw6q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jfwf-28xr-xw6q","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T07:02:15.138Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-49efaad02dc51d131287201acc8cc23a"],"technology":"github.com/rclone/rclone","known_exclusions":[],"conditions_summary":"### Summary\nThe RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication.\n\n### Preconditions\n\nPreconditions for this vulnerability are:\n\n- The rclone remote control API **must** be enabled, either by the `--rc` flag or by running the `rclone rcd` server\n- The remote control API **must** be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use\n- The rc must have been deployed **without** global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc\n\n\n### Details\nThe root cause consists of the following pieces:\n\n1. `operations/fsinfo` is not protected with `AuthRequired: true`\n2. `operations/fsinfo` calls `rc.GetFs(...)` on attacker-controlled input\n3. `rc.GetFs(...)` suppor","public_affected_ranges":[">= 1.48.0, <= 1.73.4"]}],"null_published_at":"2026-11-07T07:07:39.866Z","source_updated_at":"2026-05-20T01:36:08.000Z","source_disclosed_at":"2026-04-22T14:45:10.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T07:02:15.138Z"}],"next_cursor":null,"snapshot_revision":"42594"}