RClone Manager Fixes Critical Local API Flaw in Version 0.2.7

Zarestia-Dev released version 0.2.7 of RClone Manager to address a critical security vulnerability that exposed local storage credentials to malicious web pages. The National Vulnerability Database assigned CVE-2026-55183 to the flaw, rating it 9.6 on the CVSS scale. This update resolves a configuration error that left the local application interface unauthenticated and accessible to other browser tabs.

Prior to version 0.2.7, the application launched the local rclone rcd service on localhost port 51900 with specific flags that disabled authentication and allowed requests from any origin. According to the advisory, these settings included --rc-no-auth, --rc-allow-origin *, and --rc-serve. This configuration meant that any website opened by the user while the daemon was running could communicate directly with the local API using the user's operating-system privileges.

Technical Context and Impact

The vulnerability stems from CWE-306, a credential management weakness, as the local API did not require authentication for access. A malicious webpage could send cross-origin requests to the unauthenticated local endpoint, effectively bypassing standard browser security boundaries. The advisory states that attackers could disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files.

The impact extends to files available through configured remotes, as the compromised API retains access to those connections. The advisory notes that while credential disclosure and file manipulation are confirmed risks, the possibility of arbitrary command execution remains unconfirmed. This distinction is important for threat modeling, as command execution would represent a significantly higher severity than data theft or modification.

This incident follows a pattern of critical flaws in remote management tools. As Threat Times reported on 2026-10-13, a critical vulnerability in Wavlink router firmware allowed remote OS command injection through a CGI script flaw. That same week, reporting highlighted a critical vulnerability in Perforce Helix Authentication Service that enabled remote code execution via default credentials. These cases underscore the risks of improper authentication in local and remote services.

Who Is Affected

Users of RClone Manager versions earlier than 0.2.7 are affected by this vulnerability. The application is a cross-platform GUI tool designed to help users manage Rclone remotes efficiently. Because the flaw relies on the local rcd service running with unsafe flags, any user who has the application installed and active is potentially exposed. The risk materializes when the user visits a malicious website while the daemon is running, as the browser context allows the attack to proceed.

The vulnerability does not require remote network access to the machine, as the service listens only on 127.0.0.1. However, the cross-origin request mechanism allows web-based attacks to bridge the gap between the browser and the local application. This makes the threat relevant to any environment where users browse the web while managing cloud storage remotes through this specific GUI tool.

What should you do?

Zarestia-Dev has released version 0.2.7, which fixes the issue by removing the unsafe startup flags from the local rclone rcd service. Users should update their installation to this version or later to mitigate the risk. Until an update is applied, users should avoid visiting untrusted websites while the RClone Manager daemon is running, as this is the primary vector for exploitation.