CVE-2026-41176
CriticalExploitedPublic exploitRclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution
Published Apr 22, 2026 · Updated Sep 10, 2026 · Also known as BIT-rclone-2026-41176, DEBIAN-CVE-2026-41176, EUVD-2026-25142, GHSA-25qr-6mpr-f7qx, GO-2026-4964, JLSEC-2026-280, ROOT-APP-GOBINARY-CVE-2026-41176, UBUNTU-CVE-2026-41176, USN-8299-1
Key Facts
Patch immediately- CVE-2026-41176 is a critical-severity vulnerability (CVSS 9.2 v4) affecting Rclone, telegraf-1.38 (chainguard), telegraf-1.39 (chainguard) and 7 more products.
- It is exploited in the wild, listed in Industry KEV feed, CIRCL KEV since May 13, 2026. Public exploit code is available.
- EPSS estimates a 3.2% probability of exploitation in the next 30 days.
- Fixed versions are available, including github.com/rclone/rclone 1.73.5, github.com/rclone/rclone v1.69.3-aikido.2, github.com/rclone/rclone v1.69.3-aikido.3.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v4
9.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
3.2%
Higher than 88.0% of all scored CVEs
Exploited in the wild
Yes
2 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-41176 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint options/set is exposed without AuthRequired: true, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set rc.NoAuth=true, which disables the authorization gate for many RC methods registered with AuthRequired: true on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | May 13, 2026 | n/a | Not reported |
| CIRCL KEV | May 13, 2026 | n/a | Not reported |
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Affected Products
58 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| RcloneRclone | >= 1.45.0, >= >= 1.45.0, < 1.73.5 | 1.73.5 |
| telegraf-1.38chainguard | See advisory | 1.38.4-r19 |
| telegraf-1.39chainguard | See advisory | 1.39.1-r0 |
| telegraf-fips-1.39minimos | See advisory | 1.39.1-r0 |
| golang-github-rclone-rclone-devubuntu | See advisory | 1.50.2-2ubuntu0.2+esm1 |
Patched Releases
github.com/rclone/rclone
1.73.5, v1.69.3-aikido.2, v1.69.3-aikido.3
golang-github-rclone-rclone-dev
1.50.2-2ubuntu0.2+esm1, 1.53.3-4ubuntu1.22.04.4, 1.60.1+dfsg-3ubuntu0.24.04.5, 1.60.1+dfsg-4ubuntu2.1, 1.60.1+dfsg-4ubuntu3.1
Rclone
1.50.2-2ubuntu0.2+esm1, 1.53.3-4ubuntu1.22.04.4, 1.55.1-1.amzn2.0.5, 1.60.1+dfsg-3ubuntu0.24.04.5, 1.60.1+dfsg-4ubuntu2.1, 1.60.1+dfsg-4ubuntu3.1, 1.73.5, 1.73.5-1.1, 1.73.5-75.amzn2023, 1.73.5-bp160.1.1, 1.74.4-bp160.1.1
Rclone_jll
1.73.5+0
rclone-bash-completion
1.73.5-1.1, 1.73.5-bp160.1.1, 1.74.4-bp160.1.1
rclone-zsh-completion
1.73.5-1.1, 1.73.5-bp160.1.1, 1.74.4-bp160.1.1
rootio-github.com/rclone/rclone
v1.69.3-root.io.1, v1.69.3-root.io.2, v1.69.3-root.io.3
telegraf-1.38
1.38.4-r19
telegraf-1.39
1.39.1-r0
telegraf-fips-1.39
1.39.1-r0
Timeline
Publicly disclosed
Apr 22, 2026
Added to Industry KEV feed
May 13, 2026
Added to CIRCL KEV
May 13, 2026
Last updated
Sep 10, 2026
Weakness Type
- CWE-15 External Control of System or Configuration Setting
- CWE-306 Missing Authentication for Critical Function
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41176.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-41176
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2026-41176
- advisoryhttps://ubuntu.com/security/CVE-2026-41176
FAQ
Common Questions.
Rclone is a command-line program to sync files and directories to and from different cloud storage providers.
Affected: Rclone versions >= 1.45.0, >= >= 1.45.0, < 1.73.5; telegraf-1.38 (chainguard); telegraf-1.39 (chainguard), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed, CIRCL KEV since May 13, 2026.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including github.com/rclone/rclone 1.73.5, github.com/rclone/rclone v1.69.3-aikido.2, github.com/rclone/rclone v1.69.3-aikido.3.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2026-41176 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo