—
GO-2026-5466
Unauthenticated backend instantiation in github.com/rclone/rclone
Quick fix
GO-2026-5466 — github.com/rclone/rclone: upgrade to the fixed version with the command below.
go get github.com/rclone/rclone@v1.73.5Details
The operations/fsinfo remote control (RC) endpoint in rclone was registered without requiring authentication. This allowed unauthenticated callers to instantiate arbitrary backends via inline backend definitions, which could lead to local command execution if the backend configuration allows it (e.g., via bearer_token_command in webdav or ssh in sftp).
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/ncw/rclone
Introduced in:
1.48.0 No fixed version published yet for github.com/ncw/rclone (go modules). Pin to a known-safe version or switch to an alternative.
Go / github.com/rclone/rclone
Introduced in:
1.49.0 Fixed in: 1.73.5 Fix
go get github.com/rclone/rclone@v1.73.5