CVE-2026-41179
CriticalPublic exploitRClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution
Published Apr 22, 2026 · Updated Sep 29, 2026 · Also known as BIT-rclone-2026-41179, DEBIAN-CVE-2026-41179, EUVD-2026-25144, GHSA-jfwf-28xr-xw6q, GO-2026-5466, JLSEC-2026-281, ROOT-APP-GOBINARY-CVE-2026-41179, UBUNTU-CVE-2026-41179
Key Facts
Patch immediately- CVE-2026-41179 is a critical-severity vulnerability (CVSS 9.2 v4) affecting Rclone, telegraf-1.38 (chainguard), telegraf-1.39 (chainguard) and 8 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 5.3% probability of exploitation in the next 30 days.
- Fixed versions are available, including github.com/rclone/rclone 1.73.5, github.com/rclone/rclone v1.69.3-aikido.2, github.com/rclone/rclone v1.69.3-aikido.3.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
CVSS v4
9.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
5.3%
Higher than 92.4% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-41179 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.
Affected Products
59 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| RcloneRclone | >= 1.48.0, >= >= 1.48.0, < 1.73.5 | 1.73.5 |
| telegraf-1.38chainguard | See advisory | 1.38.4-r19 |
| telegraf-1.39chainguard | See advisory | 1.39.1-r0 |
| telegraf-fips-1.39minimos | See advisory | 1.39.1-r0 |
| golang-github-rclone-rclone-devubuntu | See advisory | 1.50.2-2ubuntu0.2+esm1 |
Patched Releases
github.com/rclone/rclone
1.73.5, v1.69.3-aikido.2, v1.69.3-aikido.3
golang-github-rclone-rclone-dev
1.50.2-2ubuntu0.2+esm1, 1.53.3-4ubuntu1.22.04.4, 1.60.1+dfsg-3ubuntu0.24.04.5, 1.60.1+dfsg-4ubuntu2.1, 1.60.1+dfsg-4ubuntu3.1
Rclone
1.50.2-2ubuntu0.2+esm1, 1.53.3-4ubuntu1.22.04.4, 1.55.1-1.amzn2.0.5, 1.60.1+dfsg-3ubuntu0.24.04.5, 1.60.1+dfsg-4ubuntu2.1, 1.60.1+dfsg-4ubuntu3.1, 1.73.5, 1.73.5-1.1, 1.73.5-75.amzn2023, 1.73.5-bp160.1.1, 1.73.5-r0, 1.74.4-bp160.1.1
Rclone_jll
1.73.5+0
rclone-bash-completion
1.73.5-1.1, 1.73.5-bp160.1.1, 1.74.4-bp160.1.1
rclone-zsh-completion
1.73.5-1.1, 1.73.5-bp160.1.1, 1.74.4-bp160.1.1
rootio-github.com/rclone/rclone
v1.69.3-root.io.1, v1.69.3-root.io.2, v1.69.3-root.io.3
telegraf-1.38
1.38.4-r19
telegraf-1.39
1.39.1-r0
telegraf-fips-1.39
1.39.1-r0
Timeline
Publicly disclosed
Apr 22, 2026
Last updated
Sep 29, 2026
Weakness Type
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-94 Improper Control of Generation of Code ('Code Injection')
- CWE-306 Missing Authentication for Critical Function
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41179.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-41179
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2026-41179
- advisoryhttps://ubuntu.com/security/CVE-2026-41179
FAQ
Common Questions.
Rclone is a command-line program to sync files and directories to and from different cloud storage providers.
Affected: Rclone versions >= 1.48.0, >= >= 1.48.0, < 1.73.5; telegraf-1.38 (chainguard); telegraf-1.39 (chainguard), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including github.com/rclone/rclone 1.73.5, github.com/rclone/rclone v1.69.3-aikido.2, github.com/rclone/rclone v1.69.3-aikido.3.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-41179 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo