CVE-2026-55183

Summary

RClone Manager had a critical authentication bypass vulnerability where the local rclone daemon was exposed on 127.0.0.1:51900 without proper authentication, allowing malicious web pages to access the API with user privileges and potentially exfiltrate credentials or files.

Exploitability

Easy to exploit with a simple cross-origin request from a malicious webpage when the daemon is running, requiring no user interaction beyond opening the page.

Blast radius

High impact as attackers can access all locally stored files and configured remotes with the user's full privileges, potentially leading to credential theft and data exfiltration across multiple storage systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.2.7 or later which fixes the authentication bypass in the local rclone daemon service.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.