CVE-2026-49980: Rclone RCD Unauthenticated Remote Code Execution via Inline Remote Instantiation

Vulnerability Overview

CVE-2026-49980 is a critical unauthenticated remote code execution (RCE) vulnerability in Rclone's remote control daemon (rcd). Classified under CWE-306 (Missing Authentication for Critical Function) and carrying a CVSS score of 9.8, the flaw allows an unauthenticated attacker to instantiate arbitrary remotes inline through the RC API when rclone rcd is started with the --rc-serve flag.

The root cause is an incomplete fix: the patch introduced for the earlier CVE-2026-41179 addressed one instantiation path but left inline remote creation via the RC API unguarded. An attacker who can reach the daemon's HTTP port can craft a single API request that defines and immediately executes an arbitrary remote — resulting in OS-level command execution under the identity of the rclone process.

Affected Software

• Product: github.com/rclone/rclone
• Vendor: Rclone (Go ecosystem)
• Vulnerable versions: 1.46.0 through 1.74.2 (inclusive)
• Patch status: No official patch released as of the disclosure date (2026-06-16). Defenders should treat all deployments in the affected range as exposed until a fix is confirmed.

Exploitation Status

A public proof-of-concept (PoC) is available. This is not a theoretical risk — weaponisation by opportunistic actors should be assumed to be underway or imminent. Any internet-exposed or network-accessible rclone rcd instance running with --rc-serve and without explicit authentication controls must be treated as actively at risk.

Defenders should prioritise: identifying rcd processes in their environment, auditing whether --rc-serve is in use, restricting RC API access to localhost or authenticated sessions, and hunting for unexpected process spawns originating from rclone.

Detection Coverage

Our detection ships seven SIEM implementations, covering the major platforms used by enterprise defenders:

• Microsoft Sentinel (KQL) — Correlates process creation events for rclone with --rc-serve in the command line alongside outbound RC API activity and child process spawns indicative of command execution.
• Splunk (SPL) — Searches endpoint process telemetry for rclone rcd invocations and follow-on child processes, with statistical deviations to surface anomalous execution chains.
• Elastic (EQL) — Uses sequence queries to chain the rclone daemon launch with suspicious child process creation within a short temporal window.
• IBM QRadar (AQL) — Queries flow and log source data for RC API calls to the default rcd port combined with process event anomalies.
• Sumo Logic — Log search queries targeting rclone process arguments and subsequent execution artefacts in endpoint logs.
• Chronicle (YARA-L) — Rule matches on process lineage where rclone is the parent of an unexpected child process, correlated with RC API network activity.
• CrowdStrike (CQL) — Falcon telemetry query detecting rclone rcd --rc-serve process creation and any resulting command execution from that parent.

The detection logic focuses on two core signals: the presence of --rc-serve in rclone command-line arguments, and unexpected child process spawning from the rclone parent — a reliable behavioural indicator of successful exploitation regardless of the specific API payload used.

Recommended Actions

• Audit all hosts for rclone rcd processes and determine whether --rc-serve is in use.
• Restrict RC API access with --rc-user / --rc-pass or bind to 127.0.0.1 only (--rc-addr 127.0.0.1:5572).
• Apply network controls to block external access to the rcd HTTP port (default 5572).
• Monitor for patches from the Rclone project and apply immediately on release.

For full query text, playbook guidance, and atomic test cases across all seven SIEM platforms, see the CVE-2026-49980 detection page.