Technical impact
The vulnerability is a server‑side request forgery that lets unauthenticated attackers supply a double‑slash root on an existing named remote using the --rc-serve flag. By doing so, the attacker can redirect HTTP and NetStorage backend requests on behalf of the victim, allowing the attacker to issue HEAD or GET requests to arbitrary hosts. The attacker can read the returned responses, exfiltrate configured custom headers, or capture valid NetStorage request signatures. This can lead to information disclosure if sensitive headers or credentials are transmitted.
Affected Systems
The affected product is the open‑source file transfer tool rclone. Versions from 1.37 through 1.73 inclusive, as well as 1.74.0 and 1.74.1, are impacted. Versions prior to 1.37 or 1.74.2 and later are considered safe.
Risk and Exploitability
The CVSS score of 8.2 indicates a high severity of risk. EPSS is not available, so the likelihood of exploitation cannot be quantified from current data. The vulnerability is not yet listed in CISA’s Known Exploited Vulnerabilities catalog, but because the attack does not require authentication and can be triggered via the CLI, it presents a high potential for abuse. Attackers can perform the exploit over the network by simply invoking rclone with the vulnerable flag, making the risk tangible for any environment where rclone is run with elevated privileges or exposed to untrusted users.
