CVE-2026-41179
OS command injection in Rclone
CVSS score
9.8
EPSS probability
%5.3
Risk score
0.5
Published
5 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Nuclei: RClone RC - Command Injection
Makefile Go / Python
https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q
Makefile Go / Python
Similar Vulnerabilities
9.8
CVE-2026-41176
Missing authentication in Rclone
R
Patch status unknown Public Exploits:2EPSS %3
9.8
CVE-2026-49980
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
R
Patch status unknownEPSS %1
9.8
CVE-2026-88018
rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
R
Patch verifiedEPSS %1
8.8
CVE-2026-59733
Path traversal in Rclone
R
Patch verified Public Exploits:1EPSS %1
7.5
CVE-2026-88045
rclone: S3 multipart declared-length memory exhaustion
R
Patch verifiedEPSS %1
9.1
CVE-2026-88044
rclone: RC per-server auth-proxy bypass
R
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-41179"