GitHub Security Advisory: GHSA-25qr-6mpr-f7qx
Package: github.com/rclone/rclone (GO)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 1.45.0, < 1.73.5
Patched in: 1.73.5

Summary: Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

Details:
### Summary
The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime configuration, including the RC option block itself. An unauthenticated attacker can set `rc.NoAuth=true`, which disables the authorization gate for many RC methods registered with `AuthRequired: true` on reachable RC servers that are started without global HTTP authentication. This can lead to unauthorized access to sensitive administrative functionality, including configuration and operational RC methods.

### Preconditions

Preconditions for this vulnerability are:

- The rclone remote control API **must** be enabled, either by the `--rc` flag or by running the `rclone rcd` server
- The remote control API **must** be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use
- The rc must have been deployed **without** global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc

### Details
The root cause is present from v1.45 onward. Some higher-impact exploitation paths became available in later releases as additional RC functionality was introduced.

The issue is caused by two properties of the RC implementation:

1. `options/set` is exposed without `AuthRequired: true`
2. the RC server enforces authorization for `AuthRequired` calls using the mutable runtime value `s.opt.NoAuth`

Relevant code paths:

- [`fs/rc/config.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/config.go)
  - registers `options/set` without `AuthRequired: true`
  - `rcOptionsSet` reshapes attacker-controlled input into global option blocks

- [`fs/rc/rcserver/rcserver.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/rcserver/rcserver.go)
  - request handling checks:
    - `if !s.opt.NoAuth && call.AuthRequired && !s.server.UsingAuth()`
  - once `rc.NoAuth` is changed to `true`, later `AuthRequired` methods become callable without credentials

This creates a runtime auth-bypass primitive on the RC interface.

After setting `rc.NoAuth=true`, previously protected administrative methods become callable, including configuration and operational endpoints such as:

- `config/listremotes`
- `config/dump`
- `config/get`
- `operations/list`
- `operations/copyfile`
- `core/command`

Relevant code for the second-stage command execution path:

- [`fs/metadata.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/metadata.go)
  - `metadataMapper()` uses `exec.Command(...)`

- [`fs/operations/rc.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go)
  - `operations/copyfile` is normally `AuthRequired: true`
  - once `rc.NoAuth=true`, it becomes reachable without credentials

This was validating using the following:
- current `master` as of 2026-04-14: `bf55d5e6d37fd86164a87782191f9e1ffcaafa82`
- latest public release teste