CVE-2026-49980: Rclone Unauthenticated Inline Remote Rce
Unrestricted inline remote instantiation in rclone's server allows unauthenticated attackers to execute arbitrary commands by supplying crafted backend connection strings. Validate user-provided backend configuration strings against the active authentication context using 'checkServeRemote()' before calling 'cache.Get()'.
Gogreprules fetch cve-2026-49980-rclone-unauthenticated-inline-remote-rce --engine opengrepDescription
Unrestricted inline remote instantiation in rclone's server allows unauthenticated attackers to execute arbitrary commands by supplying crafted backend connection strings. Validate user-provided backend configuration strings against the active authentication context using 'checkServeRemote()' before calling 'cache.Get()'.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.