/Vulnerability Library

Rclone RC - Broken Access Control

CVE-2026-41176
Verified

Description

Rclone >= 1.45.0 and < 1.73.5 contains a broken access control vulnerability caused by unauthenticated access to the RC endpoint `options/set` allowing mutation of global runtime configuration, letting unauthenticated attackers access sensitive administrative functions, exploit requires RC server started without global HTTP authentication.

Severity

Critical

CVSS Score

9.2

Exploit Probability

3%

Affected Product

rclone

Published Date

April 23, 2026

Template Author

theamanrawat

CVE-2026-41176.yaml
9.2Score

CVSS Metrics

CVE ID:
cve-2026-41176
CWE ID:
cwe-306

References

https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qxhttps://nvd.nist.gov/vuln/detail/CVE-2026-41176

Remediation Steps

Upgrade to version 1.73.5 or later.