rclone EUVD-2026-109450

All of the following non-default conditions must hold: (1) rclone rcd --rc-serve is enabled (default off); (2) the RC listener is reachable by the attacker (default bind is loopback only); (3) no RC HTTP authentication is configured; (4) --rc-no-auth is NOT set (this concerns the intermediate gated state, not the fully-open mode); (5) an http or netstorage named remote already exists in the config and the attacker knows or guesses its name. Custom-header disclosure additionally requires that the HTTP remote has configured headers. For HTTPS remotes the attacker endpoint must complete a TLS handshake with a certificate rclone trusts before headers are sent, unless --no-check-certificate is set. These factors sharply limit real-world exposure despite the network attack vector; only read-style HEAD/GET primitives are demonstrated, with no write capability.

This is a genuine but conditional SSRF (CWE-918) with associated credential/header exposure (CWE-522). The input supplies only a CVSS 4.0 vector (8.2: AV:N/AC:H/AT:P/PR:N/UI:N/VC:H) and the vuln.today priority 'this_week'; no EPSS score and no CISA KEV status are provided, so widespread or confirmed active exploitation cannot be asserted. The signals are internally consistent rather than conflicting: PR:N reflects that the named-remote gate is reached pre-auth, while AC:H and AT:P correctly capture that exploitation needs a specific non-default deployment (the GHSA author independently recommends CVSS 3.1 5.9 with AC:H, noting the same impact at AC:L would score 7.5). The real-world priority is therefore moderate and deployment-gated, not a drop-everything emergency: impact is confidentiality-only (HEAD/GET response disclosure, custom-header leakage, and NetStorage signing-oracle behavior) with no demonstrated write or integrity/availability impact. One data point warrants caution - the NVD/package metadata states fixed in 1.74.2 and affected <=1.74.1, yet the advisory body reports the behavior was still confirmed on v1.75.1 and present on current master, framing this as an incomplete-fix follow-up to CVE-2026-49980; verify the actual fixed build with the rclone maintainers.

An operator runs rclone rcd --rc-serve reachable beyond loopback with no RC HTTP authentication and an existing http or netstorage remote configured. A remote attacker who knows (or guesses) that remote's name requests it with a scheme-relative //attacker-host:port/path root, which passes the named-remote gate but causes the backend to resolve the attacker's authority, returning the response body and leaking the remote's configured custom headers or a valid NetStorage request signature. A harmless loopback reproduction (Python PoC scripts using synthetic credentials) is included in the GHSA advisory, demonstrating the behavior but not verified as a weaponized exploit against production endpoints.