github.com/ncw/rclone vulnerabilities (Go)

2 vulnerabilities.

• github.com/ncw/rclone Go Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix CVE-2026-49980 Fix available 9.8 CriticalJune 8, 2026
• github.com/ncw/rclone Go RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution CVE-2026-41179 Public exploitFix available 9.2 CriticalApril 20, 2026