—
GO-2026-5596
Unauthenticated command execution in rclone rcd via inline remotes in github.com/rclone/rclone
Quick fix
GO-2026-5596 — github.com/rclone/rclone: upgrade to the fixed version with the command below.
go get github.com/rclone/rclone@v1.74.3Details
The --rc-serve path in rclone allows unauthenticated remote instantiation, enabling unauthenticated command execution. An attacker can use inline remote backend options such as sftp ssh to run arbitrary commands as the rclone user.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/rclone/rclone
Introduced in:
1.49.0 Fixed in: 1.74.3 Fix
go get github.com/rclone/rclone@v1.74.3 Go / github.com/ncw/rclone
Introduced in:
1.46.0 No fixed version published yet for github.com/ncw/rclone (go modules). Pin to a known-safe version or switch to an alternative.
References
- https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv [ADVISORY]
- https://github.com/rclone/rclone/commit/48da1774f4999d1d46543308b9a7fe75585dbfc4 [FIX]
- https://github.com/rclone/rclone/commit/9222ed2c5a7678de7fa620214b0858311c707a29 [FIX]
- https://access.redhat.com/security/cve/CVE-2026-49980 [WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2492478 [WEB]
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49980.json [WEB]