{"id":"CVE-2026-55183","summary":"RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page","details":"RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.","aliases":["GHSA-f3qj-7hx5-q4c8"],"modified":"2026-10-15T02:47:23.600369676Z","published":"2026-10-13T16:19:53.382Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-306"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55183.json"},"references":[{"type":"WEB","url":"https://github.com/Zarestia-Dev/rclone-manager/releases/tag/v0.2.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55183.json"},{"type":"ADVISORY","url":"https://github.com/Zarestia-Dev/rclone-manager/security/advisories/GHSA-f3qj-7hx5-q4c8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55183"},{"type":"FIX","url":"https://github.com/Zarestia-Dev/rclone-manager/commit/daa379498fc1aac453bcf1864d7ea072b80ffbe8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zarestia-dev/rclone-manager","events":[{"introduced":"0"},{"fixed":"daa379498fc1aac453bcf1864d7ea072b80ffbe8"},{"fixed":"08c5d7f55ba62fe636e0e876aafd528a3edd4dde"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"0.2.7"}]}}],"versions":["v0.2.6","headless-v0.2.6","v0.2.5","headless-v0.2.5","headless-v0.2.4","v0.2.4","v0.2.3","headless-v0.2.3","v0.2.2","headless-v0.2.2","v0.2.1","headless-v0.2.1","v0.2.0","headless-v0.2.0","v0.1.9","headless-v0.1.9","v0.1.8","headless-v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3-beta","v0.1.2-beta","v0.1.1-beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55183.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}