CVE-2026-41179

CRITICAL NUCLEI

RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

Title source: cna

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-41179. PoCs published by s-vx, pssec-io. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository provides a functional proof-of-concept exploit for CVE-2026-41179, a remote command execution vulnerability in Rclone's `/operations/fsinfo` endpoint. The exploit leverages a crafted `bearer_token_command` parameter to execute arbitrary commands on the target system via improper input validation.

Description

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.

Exploits (2)

github WORKING POC

by s-vx · pythonpoc

https://github.com/s-vx/CVE-2026-41179

View Code ZIP pw:eip

This repository provides a functional proof-of-concept exploit for CVE-2026-41179, a remote command execution vulnerability in Rclone's `/operations/fsinfo` endpoint. The exploit leverages a crafted `bearer_token_command` parameter to execute arbitrary commands on the target system via improper input validation.

Classification

Working Poc 98%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Rclone v1.73.3 (and likely other vulnerable versions)

No auth needed

Prerequisites: Network access to the Rclone remote control (RC) interface (default port 5572) · Rclone configured with `--rc-addr` enabled (exposed interface)

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

mistral-large-3 · analyzed Jul 27, 2026 Full analysis →

github WORKING POC

by pssec-io · shellpoc

https://github.com/pssec-io/CVE-2026-41179

View Code ZIP pw:eip

This repository contains a functional exploit for CVE-2026-41179, an unauthenticated RCE vulnerability in rclone's RC API. The exploit leverages the WebDAV backend's `bearer_token_command` parameter to achieve arbitrary command execution via crafted POST requests to the `/operations/fsinfo` endpoint.