Detect Rclone RCD Unauthenticated Command Execution via Inline Remote Instantiation (CVE-2026-49980) in Splunk
CVE-2026-49980 is a critical unauthenticated remote code execution vulnerability in Rclone versions 1.46.0 through 1.74.2. When the rclone remote control daemon (rcd) is started with the --rc-serve flag, an attacker can instantiate arbitrary remotes inline via the RC API without authentication, bypassing the fix introduced for CVE-2026-41179. This allows execution of arbitrary commands on the host running rclone rcd. CVSS 9.8. PoC is publicly available.
MITRE ATT&CK
SPL Detection Query
index=* (sourcetype=sysmon OR sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=linux_audit OR sourcetype=osquery)
| eval proc_name=lower(coalesce(process_name, Image, comm))
| eval cmdline=coalesce(CommandLine, cmdline, process)
| where (proc_name IN ("rclone", "rclone.exe") AND (like(cmdline, "%rcd%") OR like(cmdline, "%rc-serve%") OR like(cmdline, "%--%rc-serve%")))
OR (dest_port=5572 AND (sourcetype=sysmon OR sourcetype=linux_audit))
| eval detection_reason=case(
proc_name IN ("rclone", "rclone.exe") AND (like(cmdline, "%rcd%") OR like(cmdline, "%--rc-serve%")), "rclone_rcd_started",
dest_port=5572, "rc_api_port_connection",
true(), "unknown"
)
| stats count, earliest(_time) as first_seen, latest(_time) as last_seen, values(cmdline) as cmdlines, values(src_ip) as src_ips by host, proc_name, detection_reason
| where count > 0
| sort -last_seenDetects rclone processes launched with rcd or --rc-serve arguments, and network connections targeting the RC API port 5572, indicating potential CVE-2026-49980 exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Scheduled backup jobs using rclone rcd in authenticated, network-restricted configurations
- DevOps tooling that wraps rclone rcd behind internal APIs
- Security testing or red team exercises in authorized environments
Other platforms for CVE-2026-49980
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated rclone rcd RC API probe
Expected signal: Process creation event for rclone with arguments including rcd and --rc-no-auth; network bind event on port 5572; outbound HTTP POST to 127.0.0.1:5572
- Test 2Inline remote instantiation via unauthenticated RC API
Expected signal: HTTP POST to /config/create on port 5572; rclone process spawned with --rc-no-auth; possible rclone.conf modification event
- Test 3Remote command execution via rclone RC /core/command endpoint
Expected signal: HTTP POST to /core/command; rclone process with --rc-no-auth flag in process tree; network event on port 5572 from unexpected source
Unlock Pro Content
Get the full detection package for CVE-2026-49980 including response playbook, investigation guide, and atomic red team tests.