Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55183— RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page

Quick assessment

Affected
Zarestia-Dev rclone-manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RClone Manager 是一款跨平台的图形界面（GUI）应用程序，旨在帮助用户高效管理 Rclone 远程存储配置。在 0.2.7 版本之前，RClone Manager 会在本地启动 Rclone RCD 服务，监听地址为 127.0.0.1:51900，并使用了以下不安全参数： （禁用认证）、 （允许所有来源的跨域请求）以及 （启用文件服务）。 因此，当该后台守护进程正在运行时，如果用户访问了恶意网页，该网页可以向未经验证认证的本地 API 发送跨域请求，并利用当前用户的操作系统权限执行操作。这些恶意请求

CVSS 9.6 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
Zarestia-Dev rclone-manager < 0.2.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55183

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page
Source: CVE Program / CVE List V5
Vulnerability Description
RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Zarestia-Dev rclone-manager < 0.2.7 -

II. Public POCs for CVE-2026-55183

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55183

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-55183 (1)

Other References for CVE-2026-55183 (1)

IV. Related Vulnerabilities

Same weakness: CWE-306

V. Comments for CVE-2026-55183

No comments yet

Leave a comment