This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-49980 →

UBUNTU-CVE-2026-49980

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --r...

Original description

The description as published by the source.

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Ubuntu:18.04:LTS rclone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:20.04:LTS rclone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:22.04:LTS rclone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.53.3-4ubuntu1.22.04.5"}]}]

Ubuntu:24.04:LTS rclone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1+dfsg-3ubuntu0.24.04.6"}]}]

Ubuntu:25.10 rclone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.10 rclone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:26.04:LTS rclone

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.60.1+dfsg-4ubuntu3.2"}]}]

References

advisory ubuntu.com
report ubuntu.com
report cve.org
report github.com