Nixpkgs security tracker

Untriaged

Permalink CVE-2026-41176

created 4 months, 2 weeks ago Activity log

Created suggestion 4 months, 2 weeks ago

Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. Starting in version 1.45.0 and prior to version 1.73.5, an unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods. Version 1.73.5 patches the issue.

References

https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx x_refsource_CONFIRMexploit
https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/config.go x_refsource_MISC
https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/rcserver/rcserver.go x_refsource_MISC

Affected products

rclone

==>= 1.45.0, < 1.73.5

Matching in nixpkgs

pkgs.rclone

Command line program to sync files and directories to and from major cloud storage

nixos-unstable 1.73.4
- nixpkgs-unstable 1.73.4
- nixos-unstable-small 1.73.5

pkgs.librclone

Rclone as a C library

nixos-unstable 1.73.4
- nixpkgs-unstable 1.73.4
- nixos-unstable-small 1.73.5

pkgs.rclone-ui

Cross-platform desktop GUI for rclone & S3

nixos-unstable 3.5.3
- nixpkgs-unstable 3.5.3
- nixos-unstable-small 3.5.3

pkgs.syncrclone

Bidirectional sync tool for rclone

nixos-unstable 0-unstable-2023-03-23
- nixpkgs-unstable 0-unstable-2023-03-23
- nixos-unstable-small 0-unstable-2023-03-23

pkgs.rclone-browser

Graphical Frontend to Rclone written in Qt

nixos-unstable 1.8.0
- nixpkgs-unstable 1.8.0
- nixos-unstable-small 1.8.0

pkgs.git-annex-remote-rclone

Use rclone supported cloud storage providers with git-annex

nixos-unstable 0.8
- nixpkgs-unstable 0.8
- nixos-unstable-small 0.8

pkgs.gnomeExtensions.rclone-manager

Imagine a Dropbox sync client but with support for over 30 cloud services, all accessible right from your top panel. This tool allows you to manage, monitor, and perform essential operations on your rclone profiles, making remote storage management a breeze. Mount remotes, monitor file changes, sync seamlessly, and navigate your storage, all in one place. Stay updated with real-time status displays for each profile and easily access event logs for a complete view of your activity. Plus, with backup and restore capabilities for your rclone configuration file, setting up multiple devices has never been simpler. Everything while keeping your data private. Unlike other programs from private companies, this tool respects your privacy, sending no information anywhere.

nixos-unstable 17
- nixpkgs-unstable 17
- nixos-unstable-small 17

pkgs.python312Packages.rclone-python

None

pkgs.python313Packages.rclone-python

Python wrapper for rclone

nixos-unstable 0.1.23
- nixpkgs-unstable 0.1.23
- nixos-unstable-small 0.1.23

pkgs.python314Packages.rclone-python