{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41176.json"
      }
    ],
    "title": "github.com/rclone/rclone: Rclone: Unauthorized access to administrative functions through unauthenticated Remote Control endpoint.",
    "tracking": {
      "current_release_date": "2026-06-30T03:55:54+00:00",
      "generator": {
        "date": "2026-06-30T03:55:54+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.0"
        }
      },
      "id": "CVE-2026-41176",
      "initial_release_date": "2026-04-22T23:57:54.075000+00:00",
      "revision_history": [
        {
          "date": "2026-04-22T23:57:54.075000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-30T14:58:09+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-06-30T03:55:54+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift API for Data Protection",
                "product": {
                  "name": "OpenShift API for Data Protection",
                  "product_id": "openshift_api_for_data_protection",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_api_data_protection:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "OpenShift API for Data Protection"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Advanced Cluster Management for Kubernetes 2",
                "product": {
                  "name": "Red Hat Advanced Cluster Management for Kubernetes 2",
                  "product_id": "red_hat_advanced_cluster_management_for_kubernetes_2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:acm:2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Advanced Cluster Management for Kubernetes 2"
          },
          {
            "category": "product_version",
            "name": "oadp/oadp-mustgather-rhel9",
            "product": {
              "name": "oadp/oadp-mustgather-rhel9",
              "product_id": "oadp/oadp-mustgather-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/oadp-mustgather-rhel9?repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "oadp/oadp-velero-restic-restore-helper-rhel9",
            "product": {
              "name": "oadp/oadp-velero-restic-restore-helper-rhel9",
              "product_id": "oadp/oadp-velero-restic-restore-helper-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/oadp-velero-restic-restore-helper-rhel9?repository_url=registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "oadp/oadp-velero-rhel9",
            "product": {
              "name": "oadp/oadp-velero-rhel9",
              "product_id": "oadp/oadp-velero-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/oadp-velero-rhel9?repository_url=registry.redhat.io/oadp/oadp-velero-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/volsync-rhel9",
            "product": {
              "name": "rhacm2/volsync-rhel9",
              "product_id": "rhacm2/volsync-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/volsync-rhel9?repository_url=registry.redhat.io/rhacm2/volsync-rhel9"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-mustgather-rhel9 as a component of OpenShift API for Data Protection",
          "product_id": "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9"
        },
        "product_reference": "oadp/oadp-mustgather-rhel9",
        "relates_to_product_reference": "openshift_api_for_data_protection"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-restic-restore-helper-rhel9 as a component of OpenShift API for Data Protection",
          "product_id": "openshift_api_for_data_protection:oadp/oadp-velero-restic-restore-helper-rhel9"
        },
        "product_reference": "oadp/oadp-velero-restic-restore-helper-rhel9",
        "relates_to_product_reference": "openshift_api_for_data_protection"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "oadp/oadp-velero-rhel9 as a component of OpenShift API for Data Protection",
          "product_id": "openshift_api_for_data_protection:oadp/oadp-velero-rhel9"
        },
        "product_reference": "oadp/oadp-velero-rhel9",
        "relates_to_product_reference": "openshift_api_for_data_protection"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/volsync-rhel9 as a component of Red Hat Advanced Cluster Management for Kubernetes 2",
          "product_id": "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9"
        },
        "product_reference": "rhacm2/volsync-rhel9",
        "relates_to_product_reference": "red_hat_advanced_cluster_management_for_kubernetes_2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-41176",
      "cwe": {
        "id": "CWE-15",
        "name": "External Control of System or Configuration Setting"
      },
      "discovery_date": "2026-04-23T01:01:10.565844+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-velero-restic-restore-helper-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-velero-rhel9"
          ]
        },
        {
          "label": "vulnerable_code_not_in_execute_path",
          "product_ids": [
            "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460989"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Rclone, a command-line program designed for synchronizing files with various cloud storage providers. An unauthenticated attacker can exploit an exposed Remote Control (RC) endpoint, `options/set`, to disable the authorization mechanism for other RC methods. This vulnerability allows the attacker to gain unauthorized access to sensitive administrative functionality, including configuration and operational control of the Rclone server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/rclone/rclone: Rclone: Unauthorized access to administrative functions through unauthenticated Remote Control endpoint.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The vulnerable functionality exists in the RC server. Thus, for the vulnerability to be exploited, the RC server must be started, via `rclone rcd` or the `--rc` flag. Additionally, the RC server must be deployed without any required authentication. Because Red Hat products either do not include this functionality, or expose it only to localhost, Red Hat assesses the impact of this vulnerability as `Important`.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9",
          "openshift_api_for_data_protection:oadp/oadp-velero-restic-restore-helper-rhel9",
          "openshift_api_for_data_protection:oadp/oadp-velero-rhel9",
          "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41176"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460989",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460989"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41176",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41176"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41176",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41176"
        },
        {
          "category": "external",
          "summary": "https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/config.go",
          "url": "https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/config.go"
        },
        {
          "category": "external",
          "summary": "https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/rcserver/rcserver.go",
          "url": "https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/rcserver/rcserver.go"
        },
        {
          "category": "external",
          "summary": "https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx",
          "url": "https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx"
        }
      ],
      "release_date": "2026-04-22T23:57:54.075000+00:00",
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-velero-restic-restore-helper-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-velero-rhel9",
            "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-velero-restic-restore-helper-rhel9",
            "openshift_api_for_data_protection:oadp/oadp-velero-rhel9",
            "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9"
          ]
        }
      ],
      "title": "github.com/rclone/rclone: Rclone: Unauthorized access to administrative functions through unauthenticated Remote Control endpoint."
    }
  ]
}