USN-8782-1: Rclone vulnerability
Ubuntu fixed Rclone CVE-2026-49980, where unauthenticated requests to the remote control API can execute arbitrary commands.
Ubuntu Security Notice USN-8782-1 addresses a flaw in which Rclone incorrectly handled unauthenticated requests to its remote control API. An attacker could exploit this issue to execute arbitrary commands with the privileges of the user invoking rclone. The notice provides patched Rclone packages for supported Ubuntu releases, and users are advised to update.
- Flaw tracked as CVE-2026-49980 affects Rclone's remote control API
- Unauthenticated requests could enable arbitrary command execution as the invoking user
- Fixed packages available via Ubuntu security notice USN-8782-1
- CVEs
- CVE-2026-49980
- Products
- Rclone
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-49980 | Rclone: Rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value… | 9.8 | <1% |
From the original article
It was discovered that Rclone incorrectly handled unauthenticated requests to the remote control API. An attacker could possibly use this issue to execute arbitrary commands as the user invoking rclone. (CVE-2026-49980)
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.