Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-11 | 1 | General1 |
| 2026-06-17 | 1 | Disclosure1 |
Top 5 Trending CVEs: 1 - CVE-2025-8088 2 - CVE-2026-49980 3 - CVE-2025-49604 4 - CVE-2026-42897 5 - CVE-2026-8054 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
The tweet simply lists five trending CVEs without providing any additional technical, exploitation, or mitigation details.
🚨High - rclone Unauthenticated Command Execution via rcd --rc-serve (CVE-2026-49980) rclone's rcd --rc-serve mode allows unauthenticated GET/HEAD requests that trigger inline remote instantiation. This bypasses the previous fix (CVE-2026-41179) and enables remote attackers to execute arbitrary commands as the rclone process user. 👉 Affected: rclone >= 1.46.0, <= 1.74.2 | Upgrade to 1.74.3
Post summary
A high‑severity CVE (CVE-2026-49980) is disclosed for rclone, where unauthenticated requests to rcd --rc-serve enable command execution; the advisory advises upgrading to version 1.74.3.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | rclone | rclone | - | - | - |