9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41179

CVE-2026-41179: RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41179

CVE-2026-41179:

9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/rclone/rclone	go	>= 1.48.0, <= 1.73.4	1.73.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a remote command execution flaw in rclone's remote control (RC) interface. The root cause is an authentication bypass on the operations/fsinfo endpoint. The analysis of the patch and the vulnerability description reveals a chain of function calls that lead to the exploit.

The init function in fs/operations/rc.go registers the operations/fsinfo endpoint. The vulnerability existed because this registration was missing AuthRequired: true, making the endpoint accessible to unauthenticated users. The patch adds this authentication requirement.
During an exploit, an attacker sends a request to the operations/fsinfo endpoint, which is handled by the operations.rcFsInfo function. This function is the entry point for the exploit.
rcFsInfo takes the attacker's input and passes it to rc.GetFs. This function is designed to create backend configurations on-the-fly from user input.
The attacker crafts the input to specify a webdav backend and includes the bearer_token_command parameter, which contains the command to be executed.
This malicious configuration is used to initialize a new WebDAV backend by calling webdav.NewFs.
During initialization, webdav.NewFs detects the bearer_token_command and calls webdav.fetchBearerToken.
Finally, webdav.fetchBearerToken executes the attacker's command using exec.Command.

Therefore, the functions operations.rcFsInfo, rc.GetFs, webdav.NewFs, and webdav.fetchBearerToken would all appear in a runtime profile or stack trace during the exploitation of this vulnerability.

Vulnerable functions

operations.rcFsInfo

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.