CVE-2026-49980 Google Chronicle · YARA-L

Detect Rclone RCD Unauthenticated Command Execution via Inline Remote Instantiation (CVE-2026-49980) in Google Chronicle

CVE-2026-49980 is a critical unauthenticated remote code execution vulnerability in Rclone versions 1.46.0 through 1.74.2. When the rclone remote control daemon (rcd) is started with the --rc-serve flag, an attacker can instantiate arbitrary remotes inline via the RC API without authentication, bypassing the fix introduced for CVE-2026-41179. This allows execution of arbitrary commands on the host running rclone rcd. CVSS 9.8. PoC is publicly available.

MITRE ATT&CK

Tactic
Initial Access Execution Lateral Movement

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_49980_rclone_rcd_unauthenticated_exec {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects rclone rcd launched with --rc-serve and related RC API activity indicative of CVE-2026-49980"
    severity = "CRITICAL"
    yara_version = "YL2.0"
    rule_version = "1.0"
  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e.principal.process.file.full_path, `(?i)rclone(\.exe)?$`)
      and (
        re.regex($e.principal.process.command_line, `(?i)\brcd\b`)
        or re.regex($e.principal.process.command_line, `(?i)--rc-serve`)
      )
    )
    or
    (
      $e.metadata.event_type = "NETWORK_CONNECTION"
      and $e.target.port = 5572
    )
  condition:
    $e
}
critical severity high confidence

Chronicle YARA-L 2.0 rule detecting rclone rcd process launches with rc-serve flag and network connections targeting port 5572, mapping to CVE-2026-49980.

Data Sources

Chronicle UDMGoogle Workspace endpoint telemetryVirusTotal Intelligence

Required Tables

UDM Events

False Positives & Tuning

  • Sanctioned use of rclone rcd in GCP environments with authentication and VPC controls
  • Automated data pipeline tooling using rclone with RC API in restricted network segments
  • Security research or threat hunting exercises against isolated hosts

Other platforms for CVE-2026-49980

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated rclone rcd RC API probe

    Expected signal: Process creation event for rclone with arguments including rcd and --rc-no-auth; network bind event on port 5572; outbound HTTP POST to 127.0.0.1:5572

  2. Test 2Inline remote instantiation via unauthenticated RC API

    Expected signal: HTTP POST to /config/create on port 5572; rclone process spawned with --rc-no-auth; possible rclone.conf modification event

  3. Test 3Remote command execution via rclone RC /core/command endpoint

    Expected signal: HTTP POST to /core/command; rclone process with --rc-no-auth flag in process tree; network event on port 5572 from unexpected source

Last updated: 2026-07-02 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify all hosts running rclone and check if rcd or --rc-serve arguments are present in running processes using endpoint telemetry or ps/tasklist output.
  2. Determine if port 5572 (or custom --rc-addr port) is exposed externally or to untrusted network segments by reviewing firewall rules and netstat/ss output.
  3. Check the rclone version on affected systems: if between 1.46.0 and 1.74.2 inclusive, treat as confirmed vulnerable and escalate immediately.
  4. Review rclone RC API access logs (if logging is enabled) for POST requests to /config/create, /operations/copyfile, or /core/command endpoints from unexpected source IPs.

Containment

  1. Immediately kill any rclone rcd processes exposed without authentication and block port 5572 at the host firewall and network perimeter until patched or reconfigured with --rc-user and --rc-pass flags.
  2. Isolate the affected host from the network if active exploitation is suspected (unusual child processes spawned by rclone, lateral movement indicators, or exfiltration traffic observed).
  3. Rotate all cloud storage credentials (API keys, OAuth tokens) stored in rclone config files on affected systems, as they may have been exfiltrated via the RC API.

Evidence Collection

  1. Collect the full rclone process command line, parent process, environment variables, and open file descriptors from the affected host before containment disrupts state.
  2. Export network connection logs and web server/proxy logs covering the RC API port for forensic review, capturing all source IPs, request paths, and payloads sent to the rclone rcd endpoint.

Escalation Criteria

  • !Escalate to incident response if child processes were spawned by rclone (e.g., shell, curl, wget), indicating successful command execution via the RC API.
  • !Escalate immediately if cloud storage credentials stored in rclone config were accessed or if data exfiltration to unknown remotes is detected via rclone transfer logs or network telemetry.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Rclone config file (~/.config/rclone/rclone.conf or %APPDATA%/rclone/rclone.conf) — check for newly added remotes with unusual names or attacker-controlled endpoints
  • >HTTP access logs on port 5572 showing POST requests to /config/create, /operations/copyfile, /core/command, or /rc/noop endpoints
  • >System process creation logs showing rclone spawning unexpected child processes (sh, bash, cmd.exe, powershell.exe)

Tuning Guidance

Reduce false positives by filtering on known authorized rclone rcd hosts and confirming --rc-user/--rc-pass flags are present (authenticated instances). Alert only on processes missing authentication flags or on connections from external/untrusted IP ranges. Consider allowlisting specific service accounts or hostnames used by managed backup pipelines. Tune port 5572 detections by correlating with process context — a network hit without an associated rclone rcd process on the same host may indicate port reuse by another service.

Hunting Queries

Hunt for all rclone rcd invocations across the fleet over the past 30 days to establish baseline and identify unmanaged or unauthorized instances.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("rclone", "rclone.exe")
| where ProcessCommandLine has_any ("rcd", "--rc-serve", "--rc-addr", "--rc-no-auth")
| summarize count(), make_set(ProcessCommandLine), make_set(DeviceName) by bin(TimeGenerated, 1h), InitiatingProcessAccountName
| order by TimeGenerated desc
Hunting — SPL
spl 
index=* sourcetype IN (sysmon, linux_audit, osquery) process_name IN ("rclone", "rclone.exe")
| search cmdline IN ("*rcd*", "*rc-serve*", "*rc-no-auth*", "*rc-addr*")
| timechart span=1h count by host

Atomic Red Team Tests

Test 1 Unauthenticated rclone rcd RC API probe
linux

Start rclone rcd with --rc-serve and no authentication, then verify the RC API is accessible without credentials by calling the /rc/noop endpoint.

Command

bash 
rclone rcd --rc-serve --rc-addr=127.0.0.1:5572 --rc-no-auth &
sleep 2
curl -s -X POST http://127.0.0.1:5572/rc/noop
echo "Exit: $?"

Cleanup

bash 
pkill -f 'rclone rcd'

Expected Telemetry

Process creation event for rclone with arguments including rcd and --rc-no-auth; network bind event on port 5572; outbound HTTP POST to 127.0.0.1:5572

Expected Detection

Alert fires on rclone rcd process with --rc-no-auth flag and network connection to RC API port

Test 2 Inline remote instantiation via unauthenticated RC API
linux

Simulate CVE-2026-49980 exploitation by creating an inline remote via the /config/create endpoint without authentication, demonstrating the bypass of CVE-2026-41179 fix.

Command

bash 
rclone rcd --rc-serve --rc-addr=127.0.0.1:5572 --rc-no-auth &
sleep 2
curl -s -X POST http://127.0.0.1:5572/config/create \
  -H 'Content-Type: application/json' \
  -d '{"name":"test-inline","type":"local","parameters":{}}'
echo "Remote created: $?"

Cleanup

bash 
pkill -f 'rclone rcd'; rclone config delete test-inline 2>/dev/null || true

Expected Telemetry

HTTP POST to /config/create on port 5572; rclone process spawned with --rc-no-auth; possible rclone.conf modification event

Expected Detection

Alert fires on rclone rcd rc-serve process; file integrity monitoring may trigger on rclone.conf modification

Test 3 Remote command execution via rclone RC /core/command endpoint
linux

After establishing unauthenticated access, invoke OS commands through the rclone RC API /core/command endpoint to demonstrate full RCE impact of CVE-2026-49980.

Command

bash 
rclone rcd --rc-serve --rc-addr=127.0.0.1:5572 --rc-no-auth &
sleep 2
curl -s -X POST http://127.0.0.1:5572/core/command \
  -H 'Content-Type: application/json' \
  -d '{"command":"version","opt":{},"returnType":"STREAM"}'
echo "Command result: $?"

Cleanup

bash 
pkill -f 'rclone rcd'

Expected Telemetry

HTTP POST to /core/command; rclone process with --rc-no-auth flag in process tree; network event on port 5572 from unexpected source

Expected Detection

Alert fires on rclone rcd process with rc-serve and no-auth flags; SIEM correlation between process creation and RC API port activity

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1048Exfiltration Over Alternative Protocol

Same Tactic: Initial Access

Popular Detections