{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41179.json" } ], "title": "github.com/rclone/rclone: Rclone: Unauthenticated local command execution via exposed RC endpoint", "tracking": { "current_release_date": "2026-06-30T03:55:58+00:00", "generator": { "date": "2026-06-30T03:55:58+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.0" } }, "id": "CVE-2026-41179", "initial_release_date": "2026-04-23T00:03:36.282000+00:00", "revision_history": [ { "date": "2026-04-23T00:03:36.282000+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-04-30T14:57:04+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-06-30T03:55:58+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "OpenShift API for Data Protection", "product": { "name": "OpenShift API for Data Protection", "product_id": "openshift_api_for_data_protection", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_api_data_protection:1" } } } ], "category": "product_family", "name": "OpenShift API for Data Protection" }, { "branches": [ { "category": "product_name", "name": "Red Hat Advanced Cluster Management for Kubernetes 2", "product": { "name": "Red Hat Advanced Cluster Management for Kubernetes 2", "product_id": "red_hat_advanced_cluster_management_for_kubernetes_2", "product_identification_helper": { "cpe": "cpe:/a:redhat:acm:2" } } } ], "category": "product_family", "name": "Red Hat Advanced Cluster Management for Kubernetes 2" }, { "category": "product_version", "name": "oadp/oadp-mustgather-rhel9", "product": { "name": "oadp/oadp-mustgather-rhel9", "product_id": "oadp/oadp-mustgather-rhel9", "product_identification_helper": { "purl": "pkg:oci/oadp-mustgather-rhel9?repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9" } } }, { "category": "product_version", "name": "oadp/oadp-velero-restic-restore-helper-rhel9", "product": { "name": "oadp/oadp-velero-restic-restore-helper-rhel9", "product_id": "oadp/oadp-velero-restic-restore-helper-rhel9", "product_identification_helper": { "purl": "pkg:oci/oadp-velero-restic-restore-helper-rhel9?repository_url=registry.redhat.io/oadp/oadp-velero-restic-restore-helper-rhel9" } } }, { "category": "product_version", "name": "oadp/oadp-velero-rhel9", "product": { "name": "oadp/oadp-velero-rhel9", "product_id": "oadp/oadp-velero-rhel9", "product_identification_helper": { "purl": "pkg:oci/oadp-velero-rhel9?repository_url=registry.redhat.io/oadp/oadp-velero-rhel9" } } }, { "category": "product_version", "name": "rhacm2/volsync-rhel9", "product": { "name": "rhacm2/volsync-rhel9", "product_id": "rhacm2/volsync-rhel9", "product_identification_helper": { "purl": "pkg:oci/volsync-rhel9?repository_url=registry.redhat.io/rhacm2/volsync-rhel9" } } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "oadp/oadp-mustgather-rhel9 as a component of OpenShift API for Data Protection", "product_id": "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9" }, "product_reference": "oadp/oadp-mustgather-rhel9", "relates_to_product_reference": "openshift_api_for_data_protection" }, { "category": "default_component_of", "full_product_name": { "name": "oadp/oadp-velero-restic-restore-helper-rhel9 as a component of OpenShift API for Data Protection", "product_id": "openshift_api_for_data_protection:oadp/oadp-velero-restic-restore-helper-rhel9" }, "product_reference": "oadp/oadp-velero-restic-restore-helper-rhel9", "relates_to_product_reference": "openshift_api_for_data_protection" }, { "category": "default_component_of", "full_product_name": { "name": "oadp/oadp-velero-rhel9 as a component of OpenShift API for Data Protection", "product_id": "openshift_api_for_data_protection:oadp/oadp-velero-rhel9" }, "product_reference": "oadp/oadp-velero-rhel9", "relates_to_product_reference": "openshift_api_for_data_protection" }, { "category": "default_component_of", "full_product_name": { "name": "rhacm2/volsync-rhel9 as a component of Red Hat Advanced Cluster Management for Kubernetes 2", "product_id": "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9" }, "product_reference": "rhacm2/volsync-rhel9", "relates_to_product_reference": "red_hat_advanced_cluster_management_for_kubernetes_2" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-41179", "cwe": { "id": "CWE-94", "name": "Improper Control of Generation of Code ('Code Injection')" }, "discovery_date": "2026-04-23T01:01:06.930343+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9", "openshift_api_for_data_protection:oadp/oadp-velero-restic-restore-helper-rhel9", "openshift_api_for_data_protection:oadp/oadp-velero-rhel9" ] }, { "label": "vulnerable_code_not_in_execute_path", "product_ids": [ "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2460988" } ], "notes": [ { "category": "description", "text": "A flaw was found in Rclone, a command-line program for syncing files with cloud storage. An unauthenticated attacker can exploit an exposed Remote Control (RC) endpoint, `operations/fsinfo`, to instantiate a malicious backend. This allows the attacker to execute arbitrary local commands during backend initialization, leading to unauthenticated local command execution on reachable RC deployments.", "title": "Vulnerability description" }, { "category": "summary", "text": "github.com/rclone/rclone: Rclone: Unauthenticated local command execution via exposed RC endpoint", "title": "Vulnerability summary" }, { "category": "other", "text": "The vulnerable functionality exists in the RC server. Thus, for the vulnerability to be exploited, the RC server must be started, via `rclone rcd` or the `--rc` flag. Additionally, the RC server must be deployed without any required authentication. Because Red Hat products either do not include this functionality, or expose it only to localhost, Red Hat assesses the impact of this vulnerability as `Important`.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_not_affected": [ "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9", "openshift_api_for_data_protection:oadp/oadp-velero-restic-restore-helper-rhel9", "openshift_api_for_data_protection:oadp/oadp-velero-rhel9", "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-41179" }, { "category": "external", "summary": "RHBZ#2460988", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460988" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41179", "url": "https://www.cve.org/CVERecord?id=CVE-2026-41179" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41179", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41179" }, { "category": "external", "summary": "https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go", "url": "https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go" }, { "category": "external", "summary": "https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go", "url": "https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go" }, { "category": "external", "summary": "https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go", "url": "https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go" }, { "category": "external", "summary": "https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q" } ], "release_date": "2026-04-23T00:03:36.282000+00:00", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9", "openshift_api_for_data_protection:oadp/oadp-velero-restic-restore-helper-rhel9", "openshift_api_for_data_protection:oadp/oadp-velero-rhel9", "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9" ] } ], "threats": [ { "category": "impact", "details": "Important", "product_ids": [ "openshift_api_for_data_protection:oadp/oadp-mustgather-rhel9", "openshift_api_for_data_protection:oadp/oadp-velero-restic-restore-helper-rhel9", "openshift_api_for_data_protection:oadp/oadp-velero-rhel9", "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9" ] } ], "title": "github.com/rclone/rclone: Rclone: Unauthenticated local command execution via exposed RC endpoint" } ] }