Rclone Release v1.73.5 - IMPORTANT Security Fix

Releases
1

Rclone 1.73.5 has been released. Find it in the rclone downloads or use rclone selfupdate to upgrade.

This is a security release to fix two CVEs in rclone and a few other small things.

Neptune (@0wnerDied on GitHub) discovered two exploitable vunlerabilities in the rclone rc.

To be vulnerable all 3 of these conditions must be met:

  • The rclone remote control API must be enabled, either by the --rc flag or by running the rclone rcd server
  • The remote control API must be reachable by the attacker - by default rclone only serves the rc to localhost unless the --rc-addr flag is in use
  • The rc must have been deployed without global RC HTTP authentication - so not using --rc-user/--rc-pass/--rc-htpasswd/etc

If these conditions apply to your rclone deployment then upgrade to v1.73.5 or add HTTP auth to the rc, eg --rc-user/--rc-pass or don't expose the rc port to untrusted uers, preferably all 3 - the rclone rc was never designed to be exposed to untrusted users.

More details:

v1.73.5 - 2026-04-19

See commits

  • Bug Fixes
    • operations: Add AuthRequired to operations/fsinfo to prevent backend creation CVE-2026-41179 (Nick Craig-Wood)
    • rc
      • Add AuthRequired to options/set to prevent auth bypass CVE-2026-41176 (Nick Craig-Wood)
      • Snapshot NoAuth at startup to prevent runtime auth bypass CVE-2026-41176 (Nick Craig-Wood)
    • filter: Fix debug logs that fire before logger is configured (Nick Craig-Wood)
  • Azureblob
    • Add Microsoft Partner Network User-Agent prefix (Nick Craig-Wood)
  • Drime
    • Fix User.EntryPermissions JSON unmarshalling (a1pcm)
  • Iclouddrive
    • Fix 'directory not found' error when the directory contains accent marks (Brais Couce)
  • S3
    • Fix TencentCOS CDN endpoint failing on bucket check (Mozi)
    • Fix empty delimiter parameter rejected by Archiware P5 server (Nick Craig-Wood)
4 Likes