CVE-2026-41176

Rclone's remote control (RC) API exposes the `options/set` endpoint without an authentication requirement, and because that endpoint can mutate global runtime configuration — including the RC option block itself — an unauthenticated attacker can enable `rc.NoAuth` and thereby disable the authorization gate on many other RC methods. The flaw affects rclone starting in version 1.45.0 and in all versions prior to 1.73.5, but only on RC servers that are reachable over the network and started without global HTTP authentication. With a single unauthenticated request an attacker gains access to sensitive administrative functionality, including configuration and operational RC methods that normally require authorization. Anyone running an affected rclone version with an RC server exposed without HTTP authentication is affected; rclone users who do not enable the RC feature are not impacted. Exploitation has not been confirmed in the wild (not in CISA KEV), but a public proof of concept exists and EPSS assigns a 32.7% probability of exploitation within 30 days (98th percentile).

What to do: Upgrade to rclone 1.73.5 or later, prioritizing any RC server reachable from untrusted networks. Until patched, restrict the RC listener to localhost or trusted networks and enable global HTTP authentication on the RC server. Review RC logs for unexpected unauthenticated calls to options/set, given the elevated 32.7% EPSS likelihood of exploitation.