| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/ncw/rclone | ≥ 1.48.0 | |
| github.com/rclone/rclone | ≥ 1.48.0, < 1.73.5≥ 1.49.0, < 1.73.5 | 1.73.5 |
| rclone | ≥ 1.48.0, < 1.73.5 | 1.73.5 |
The RC endpoint operations/fsinfo is exposed without AuthRequired: true and accepts attacker-controlled fs input. Because rc.GetFs(...) supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, bearer_token_command is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication.
Preconditions for this vulnerability are:
--rc flag or by running the rclone rcd server--rc-addr flag is in use--rc-user/--rc-pass/--rc-htpasswd/etcThe root cause consists of the following pieces:
operations/fsinfo is not protected with AuthRequired: trueoperations/fsinfo calls rc.GetFs(...) on attacker-controlled inputrc.GetFs(...) supports inline backend creation through object-valued fsbearer_token_commandRelevant code paths:
operations/fsinfo is registered without AuthRequired: truercFsInfo() calls rc.GetFs(ctx, in)GetFs() / GetFsNamed() can parse an object-valued fsgetConfigMap() converts attacker-controlled JSON into a backend config stringRunning one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freebearer_token_command is a supported backend optionNewFs(...) calls fetchAndSetBearerToken() when bearer_token_command is setfetchBearerToken() invokes exec.Command(...)This creates a practical single-request unauthenticated command-execution primitive on reachable RC servers without global HTTP authentication.
This was alidated on:
master as of 2026-04-14: bf55d5e6d37fd86164a87782191f9e1ffcaafa82v1.73.4This was also validated on a public amd64 Ubuntu host controlled by the tester, using direct host execution (not containerized PoC execution).
Start a vulnerable RC server:
rclone rcd --rc-addr 127.0.0.1:5572
No --rc-user, no --rc-pass, no --rc-htpasswd.
Then send a single request:
curl -sS -X POST http://127.0.0.1:5572/operations/fsinfo \
--data-urlencode "fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/touch /tmp/rclone_fsinfo_rce_poc_marker':"
Expected result:
operations/fsinfo/tmp/rclone_fsinfo_rce_poc_marker is created on the hostThis is effectively a single-request unauthenticated command-execution vulnerability on reachable RC deployments without global HTTP authentication.
In practice, command execution in the rclone process context can lead to higher-impact outcomes such as local file read, file write, or shell access, depending on the deployed environment.
This was successfully reproduced:
On the public host it was confirmed:
operations/fsinfo exploit worked