CVE-2026-41176

OVERVIEW CVE-2026-41176 is an authentication bypass vulnerability in Rclone, a command-line file synchronization tool for cloud storage. The vulnerability affects Rclone versions 1.45.0 through 1.73.4. The RC endpoint "options/set" is exposed without proper authentication requirements, allowing unauthenticated attackers to modify global runtime configuration parameters on accessible RC servers. SEVERITY This vulnerability has a network-based attack vector with low complexity. An unauthenticated attacker can set the rc.NoAuth parameter to true, which disables authorization checks for numerous RC methods that normally require authentication. This leads to unauthorized access to sensitive administrative functionality, including configuration and operational commands. The FAUCET Risk Score of 53.0/100 indicates moderate risk, though the CVSS score is not yet assigned. The EPSS score of 0.0004 suggests current exploitation probability is very low. EXPLOITATION STATUS The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog, and it is classified as inactive on the Hot List. No public exploit code or active exploitation has been identified in the threat landscape. The patch is available in Rclone version 1.73.5 and later, and community attention appears limited. Organizations using affected versions should prioritize patching, particularly those operating RC servers with network accessibility.