QSN-8782-1: Rclone vulnerability
2026-09-18

Summary:
rclone could be made to run programs if it received specially crafted
network traffic.

Details:
It was discovered that Rclone incorrectly handled unauthenticated requests
to the remote control API. An attacker could possibly use this issue to
execute arbitrary commands as the user invoking rclone. (CVE-2026-49980)

Affected QuantaStor releases:
  6.9.1.001 jammy: rclone 1.74.3 (fixed in 1.53.3-4ubuntu1.22.04.5)
  6.9.0.464 jammy: rclone 1.74.3 (fixed in 1.53.3-4ubuntu1.22.04.5)
  6.8.6.015 jammy: rclone 1.74.3 (fixed in 1.53.3-4ubuntu1.22.04.5)
  6.8.5.018 jammy: rclone 1.74.3 (fixed in 1.53.3-4ubuntu1.22.04.5)
  6.8.4.038 jammy: rclone 1.74.3 (fixed in 1.53.3-4ubuntu1.22.04.5)
  6.8.3.018 jammy: rclone 1.74.3 (fixed in 1.53.3-4ubuntu1.22.04.5)
  6.8.2.002 jammy: rclone 1.74.3 (fixed in 1.53.3-4ubuntu1.22.04.5)
  6.8.1.007 jammy: rclone 1.74.3 (fixed in 1.53.3-4ubuntu1.22.04.5)
  6.8.0.205 jammy: rclone 1.74.3 (fixed in 1.53.3-4ubuntu1.22.04.5)

CVEs: CVE-2026-49980

References:
  https://ubuntu.com/security/notices/USN-8782-1