← All notices | Source (USN-8782-1) | Text version
QSN-8782-1: Rclone vulnerability
September 18, 2026
Summary
rclone could be made to run programs if it received specially crafted network traffic.
Details
It was discovered that Rclone incorrectly handled unauthenticated requests to the remote control API. An attacker could possibly use this issue to execute arbitrary commands as the user invoking rclone. (CVE-2026-49980)
Affected QuantaStor releases
| Release | Platform | Package | Exposure | Shipped version | Fixed version | Status |
|---|---|---|---|---|---|---|
| 6.9.1.001 | Ubuntu 22.04 LTS | rclone | Internally-facing | 1.74.3 | 1.53.3-4ubuntu1.22.04.5 | Fixed in this release |
| 6.9.0.464 | Ubuntu 22.04 LTS | rclone | Internally-facing | 1.74.3 | 1.53.3-4ubuntu1.22.04.5 | Fixed in this release |
| 6.8.6.015 | Ubuntu 22.04 LTS | rclone | Internally-facing | 1.74.3 | 1.53.3-4ubuntu1.22.04.5 | Fixed in this release |
| 6.8.5.018 | Ubuntu 22.04 LTS | rclone | Internally-facing | 1.74.3 | 1.53.3-4ubuntu1.22.04.5 | Fixed in this release |
| 6.8.4.038 | Ubuntu 22.04 LTS | rclone | Internally-facing | 1.74.3 | 1.53.3-4ubuntu1.22.04.5 | Fixed in this release |
| 6.8.3.018 | Ubuntu 22.04 LTS | rclone | Internally-facing | 1.74.3 | 1.53.3-4ubuntu1.22.04.5 | Fixed in this release |
| 6.8.2.002 | Ubuntu 22.04 LTS | rclone | Internally-facing | 1.74.3 | 1.53.3-4ubuntu1.22.04.5 | Fixed in this release |
| 6.8.1.007 | Ubuntu 22.04 LTS | rclone | Internally-facing | 1.74.3 | 1.53.3-4ubuntu1.22.04.5 | Fixed in this release |
| 6.8.0.205 | Ubuntu 22.04 LTS | rclone | Internally-facing | 1.74.3 | 1.53.3-4ubuntu1.22.04.5 | Fixed in this release |
Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.
CVEs
References
https://ubuntu.com/security/notices/USN-8782-1
https://nvd.nist.gov/vuln/detail/CVE-2026-49980
Update
Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:
| Platform | Package | Version |
|---|---|---|
| Ubuntu 22.04 LTS | rclone | 1.53.3-4ubuntu1.22.04.5 |
| Ubuntu 24.04 LTS | rclone | 1.60.1+dfsg-3ubuntu0.24.04.6 |
| resolute | rclone | 1.60.1+dfsg-4ubuntu3.2 |