CVE-2026-49980: Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

Synopsis

This is an unauthenticated remote command execution vulnerability in Rclone's rcd HTTP daemon (versions 1.46.0 through 1.74.3). When the daemon is started with --rc-serve, it accepts GET and HEAD requests at paths that encode a remote backend specification inline in the URL; because the backend is initialized from that attacker-controlled string without any authentication check, an attacker can pass backend options that trigger local command execution as the rclone process user. Successful exploitation gives the attacker full code execution on the host running rclone, with no credentials required. No fix version is currently published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the rclone rcd HTTP daemon over the network; the service is exposed on a TCP port and can be targeted from any network-accessible host.

• AuthenticationNot required

  No credentials or session token are needed; the vulnerable request path accepts unauthenticated GET and HEAD requests.

• Victim interactionNot required

  The attacker sends a single crafted HTTP request with no user interaction required on the part of any operator or end user.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout knowledge, or environmental prerequisites are needed beyond network access to the daemon.

Blast Radius

• The attacker executes arbitrary operating system commands as the user account running the rclone process, gaining a foothold on the host.
• Any files, cloud credentials, or secrets readable by the rclone process user are exposed to the attacker.
• The attacker can write or delete files accessible to the rclone process, including any cloud storage paths that rclone has configured credentials for.
• The rclone process and any dependent services can be crashed or disrupted by the attacker at will.