Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0f3342e3-73ba-11f1-910d-3c7c3fba4204 advisory.

    https://github.com/rclone/rclone/security/advisories/GHSA-qw24-gh76-8rvv reports:
    Rclone is a command-line program to sync files and directories to     and from different cloud storage providers.From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts     unauthenticated GET and HEAD     requests to paths of the form: /[remote:path]/object.The remote     value is parsed from the URL and passed to normal backend initialization.
    Inline remote configuration can set backend options that execute     local commands during initialization.As a result, a single     unauthenticated GET or HEAD request can execute a command as the     rclone process user.
    Thanks to Nick Craig-Wood for reporting this vulnerability.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of rclone installed on the remote host is prior to 1.55.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3494 advisory.

    Rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests     to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal     backend initialization. Inline remote configuration can set backend options that execute local commands     during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as     the rclone process user. This vulnerability is fixed in 1.74.3. (CVE-2026-49980)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1907 advisory.

    Rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests     to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal     backend initialization. Inline remote configuration can set backend options that execute local commands     during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as     the rclone process user. This vulnerability is fixed in 1.74.3. (CVE-2026-49980)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests     to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal     backend initialization. Inline remote configuration can set backend options that execute local commands     during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as     the rclone process user. This vulnerability is fixed in 1.74.3. (CVE-2026-49980)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Rclone installed on the remote host is 1.46.x prior to 1.74.3. It is, therefore, affected by an unauthenticated command execution vulnerability:

  - rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form     /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend     initialization. Inline remote configuration can set backend options that execute local commands     during initialization. As a result, a single unauthenticated GET or HEAD request can execute a     command as the rclone process user. (CVE-2026-49980)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Rclone is a command-line program to sync files and directories to and from different cloud storage
    providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests
    to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal
    backend initialization. Inline remote configuration can set backend options that execute local commands
    during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as
    the rclone process user. This vulnerability is fixed in 1.74.3. (CVE-2026-49980)

ID	Name	Product	Family	Severity
323939	FreeBSD : rclone -- Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation (0f3342e3-73ba-11f1-910d-3c7c3fba4204)	Nessus	FreeBSD Local Security Checks	critical
323717	Amazon Linux 2 : rclone, --advisory ALAS2-2026-3494 (ALAS-2026-3494)	Nessus	Amazon Linux Local Security Checks	critical
323716	Amazon Linux 2023 : rclone (ALAS2023-2026-1907)	Nessus	Amazon Linux Local Security Checks	critical
322634	Linux Distros Unpatched Vulnerability : CVE-2026-49980	Nessus	Misc.	critical
321508	Rclone 1.46.x < 1.74.3 Unauthenticated Command Execution	Nessus	Misc.	critical
443312	SCA: security update for github.com/rclone/rclone (GHSA-qw24-gh76-8rvv)	Tenable Cloud Security	SCA Checks	critical
443312	SCA: security update for github.com/rclone/rclone (GHSA-qw24-gh76-8rvv)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2026-49980

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical