# Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

Unauthenticated GET/HEAD to rclone rcd --rc-serve paths with inline remote config executes OS commands as the rclone user, bypassing the prior fix.

- Payout: Research
- Severity: critical
- Program: Rclone
- Found by: kamil-sawicki
- Disclosed: 2026-06-16
- CVE: CVE-2026-49980
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-qw24-gh76-8rvv
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-qw24-gh76-8rvv
- Tags: area:cloud domain:infra impact:data-leak impact:rce kind:research platform:ghsa sev:critical tech:go technique:incomplete-fix technique:source-review vuln:auth-bypass vuln:info-disclosure vuln:misconfiguration vuln:rce

**Target:** rclone rcd RC HTTP file-serving endpoint (--rc-serve)
**Root cause:** The --rc-serve handler parses `/[remote:path]/object` and passes the inline remote string to normal backend initialization, which honors inline backend option overrides that can execute local commands; the prior CVE-2026-41179 fix did not block this path.
**Steps:**
1. Deploy `rclone rcd --rc-serve` without `--rc-user`/`--rc-pass`/`--rc-htpasswd`.
2. Send an unauthenticated `GET` (or `HEAD`) to `/[remote:path]/object` where the inline remote sets a backend option that runs a local command during initialization.
3. Backend initialization executes the command as the rclone process user.
**How found:** Researcher examined the --rc-serve path parsing `/[remote:path]/object` and noticed the remote value flows into normal backend initialization, then tested inline remote configuration and inline backend option overrides (added in 1.55.0) to reach command execution, and inline `global.*` options to mutate process config.
**Exploitation:** Single unauthenticated GET/HEAD request to the RC HTTP listener; the inline remote in the URL path is initialized as a backend, and inline backend option overrides execute a command as the rclone user. Same path also enables unauthenticated local file read via inline `local` remotes and mutation of `global.*` options such as `global.http_proxy`.
**Escalation:** Browser subresource requests can reach a localhost-only RC listener: a public HTTPS page with an `<img>` pointing at `http://127.0.0.1:5572/...` triggered the payload in Firefox, turning a localhost-bound RC into a drive-by vector.
**Insight:** When a file-serving endpoint accepts `remote:path` in the URL, the remote string is attacker-controlled config, not just a path — check whether inline backend option overrides (and `global.*` options) are honored during initialization, and test both GET and HEAD since both trigger backend init.