CVE-2026-41176 is a critical authentication bypass in rclone, scored CVSS 9.8. The RC endpoint options/set needs no login but can set rc.NoAuth to true, which switches off authorization for other RC methods. Versions 1.45.0 to before 1.73.5 are affected. Upgrade to 1.73.5.
What's affected
- Affected: rclone from 1.45.0 up to but not including 1.73.5
- Fixed: 1.73.5
The advisory lists three preconditions, and all three must hold:
- The remote control API is enabled, with the rc flag or by running rclone rcd.
- The attacker can reach it. By default rclone serves RC only on localhost unless an address flag widens it.
- The RC was started without global HTTP authentication, meaning no RC user, password or htpasswd setting.
The advisory says the root cause dates to 1.45 and that higher impact paths appeared in later releases as RC functionality grew. Servers that use global RC authentication are in a different position from those that do not.
How to check if you're exposed
Find the version:
rclone version
Then look for RC servers. Check running processes and service files for the rc options:
ps aux | grep -i "rclone" | grep -i "rc"
systemctl list-units --type=service | grep -i rclone
Look for the rc flag, the rcd command, and an rc address that is not localhost. Then check whether RC user and password settings, or an htpasswd file, are present. A server with RC enabled, a wide address and no global authentication is the case this CVE describes.
Also check what else listens on the host's RC port from other machines, using your usual network scan or firewall rules.
What to do now
- Upgrade rclone to 1.73.5 or later on every host, including build servers and containers.
- Search for rclone processes and services started with the rc flag or rcd.
- Set global RC authentication on any RC server you keep: a user and password, or an htpasswd file.
- Bind RC to localhost or a private interface and block the port at the firewall.
- If an exposed RC server ran without authentication, review its configuration for changes and rotate remote credentials stored in the rclone config.
- Check whether secrets in rclone.conf for cloud storage were reachable and rotate them if there is doubt.
Why it matters
The record lists CWE-306, missing authentication for a critical function, and CWE-15, external control of system or configuration setting. The first is plain: one method was left open. The second is the sharper lesson. That open method could change the server's own option block, including the flag that decides whether other methods need a login. A single unprotected setting call undid the protection for the rest.
The advisory says the unlocked methods include configuration listing and dumping, file operations and a core command method. Per the advisory, one later path involves running a command through a metadata mapper. Those make the impact depend on your rclone version and on what credentials the host holds. rclone configurations usually hold keys to cloud storage, so exposure reaches beyond the host.
The preconditions matter. A default install that never enables RC is not exposed through this route. The record does not flag exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I safe if RC only listens on localhost?
The advisory says that by default RC is served only to localhost. Other local users or processes could still reach it, so upgrade anyway.
What fixes it?
rclone 1.73.5, and global RC authentication reduces the risk in the meantime.
Sources
Last reviewed: 19 October 2026.
