CVE-2026-49980 CrowdStrike LogScale · LogScale

Detect Rclone RCD Unauthenticated Command Execution via Inline Remote Instantiation (CVE-2026-49980) in CrowdStrike LogScale

CVE-2026-49980 is a critical unauthenticated remote code execution vulnerability in Rclone versions 1.46.0 through 1.74.2. When the rclone remote control daemon (rcd) is started with the --rc-serve flag, an attacker can instantiate arbitrary remotes inline via the RC API without authentication, bypassing the fix introduced for CVE-2026-41179. This allows execution of arbitrary commands on the host running rclone rcd. CVSS 9.8. PoC is publicly available.

MITRE ATT&CK

Tactic
Initial Access Execution Lateral Movement

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName IN ("ProcessRollup2", "NetworkConnectIP4", "NetworkConnectIP6")
| eval is_rclone_rcd = if(
    match(FileName, "(?i)rclone(\.exe)?$") AND (match(CommandLine, "(?i)\brcd\b") OR match(CommandLine, "(?i)--rc-serve")),
    1, 0
  )
| eval is_rc_port = if(RemotePort == 5572, 1, 0)
| where is_rclone_rcd == 1 OR is_rc_port == 1
| stats count, earliest(timestamp) as first_seen, latest(timestamp) as last_seen, values(CommandLine) as cmdlines, values(RemoteIP) as remote_ips by aid, ComputerName, UserName, FileName, is_rclone_rcd, is_rc_port
| sort last_seen desc
critical severity high confidence

CrowdStrike Falcon LogScale CQL detecting rclone rcd process executions and RC API port connections, covering CVE-2026-49980 on Windows and Linux endpoints.

Data Sources

CrowdStrike Falcon SensorCrowdStrike Falcon ProcessRollup2CrowdStrike Falcon NetworkConnect events

Required Tables

ProcessRollup2NetworkConnectIP4NetworkConnectIP6

False Positives & Tuning

  • Managed endpoints running rclone rcd for sanctioned backup operations with authentication
  • Threat simulation or red team tooling using rclone rcd against authorized targets
  • Cloud-connected workstations using rclone for storage sync with rc-serve and firewall restrictions

Other platforms for CVE-2026-49980

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated rclone rcd RC API probe

    Expected signal: Process creation event for rclone with arguments including rcd and --rc-no-auth; network bind event on port 5572; outbound HTTP POST to 127.0.0.1:5572

  2. Test 2Inline remote instantiation via unauthenticated RC API

    Expected signal: HTTP POST to /config/create on port 5572; rclone process spawned with --rc-no-auth; possible rclone.conf modification event

  3. Test 3Remote command execution via rclone RC /core/command endpoint

    Expected signal: HTTP POST to /core/command; rclone process with --rc-no-auth flag in process tree; network event on port 5572 from unexpected source

Last updated: 2026-06-21 Research depth: standard
References (2)

Unlock Pro Content

Get the full detection package for CVE-2026-49980 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1048Exfiltration Over Alternative Protocol

Same Tactic: Initial Access

Popular Detections