PatchSiren cyber security CVE debrief

CVE-2026-41176 rclone CVE debrief

CVE-2026-41176 is a critical vulnerability in Rclone, a command-line program for syncing files and directories with cloud storage providers. The vulnerability exists in the RC endpoint `options/set`, which is exposed without requiring authentication. This allows an unauthenticated attacker to mutate global runtime configuration, including the RC option block itself. Specifically, an attacker can set `rc.NoAuth=true`, disabling the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. The vulnerability affects Rclone versions starting from 1.45.0 and prior to 1.73.5. Version 1.73.5 patches the issue.

Vendor: rclone
Product: Unknown
CVSS: CRITICAL 9.2
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-04-23
Original CVE updated: 2026-07-15
Advisory published: 2026-04-23
Advisory updated: 2026-07-15

Who should care

Organizations using Rclone for cloud storage synchronization should prioritize patching this vulnerability. Unauthenticated access can lead to significant security breaches, including unauthorized configuration changes and potential data exposure. Defender should focus on updating Rclone to version 1.73.5 or later and review their current Rclone configurations and usage.

Technical summary

The RC endpoint `options/set` in Rclone is exposed without authentication requirements. An unauthenticated attacker can exploit this to disable authentication for other RC methods, gaining unauthorized access to administrative functionality. This affects Rclone versions from 1.45.0 up to but not including 1.73.5. The issue is patched in version 1.73.5. The vulnerability is characterized by a CVSS score of 9.2 and a severity of CRITICAL.

Defensive priority

High. Immediate patching of Rclone to version 1.73.5 or later is recommended. Review current configurations and usage to ensure no unauthorized access has been granted.

Recommended defensive actions

Update Rclone to version 1.73.5 or later
Review and restrict access to RC endpoints
Monitor for suspicious activity on Rclone instances
Implement additional authentication mechanisms for RC servers
Conduct a thorough inventory of Rclone usage within the organization

Evidence notes

The CVE-2026-41176 vulnerability is well-documented in various sources, including the official CVE record and NVD detail pages. Vendor advisories and mitigation strategies are available, emphasizing the importance of updating to version 1.73.5. The vulnerability's criticality and potential impact underscore the need for prompt action.

Sources and references

Verified primary and authoritative sources

CVE-2026-41176 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-41176

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-41176 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41176

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/config.go

[email protected] - Product
Source reference
Unverified legacy reference

URL: https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/rcserver/rcserver.go

[email protected] - Product
Mitigation or vendor reference
Unverified legacy reference

URL: https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx

[email protected] - Exploit, Vendor Advisory
Source reference
Unverified legacy reference

URL: https://access.redhat.com/security/cve/CVE-2026-41176

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41176.json

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.