What is CVE-2026-55183?

CVE-2026-55183 is a critical-severity vulnerability in Zarestia-Dev Rclone-Manager, classified under Missing Authentication for Critical Function. CVSS score: 9.6/10. Published 2026-10-13.

How severe is CVE-2026-55183?

Critical severity. CVSS v3 base score is 9.6 out of 10.

Auth bypass in Zarestia-Dev Rclone-Manager

CVE-2026-55183

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, and --rc-serve. A malicious web page opened by a user while the daemon is running can therefore send cross-origin requests to the unauthenticated local API with the user's operating-system privileges. The requests can disclose configured storage credentials and potentially access, upload, modify, or exfiltrate locally stored files accessible to the user and files available through configured remotes; the advisory's possible command-execution impact remains unconfirmed. This issue is fixed in version 0.2.7.

Vulnerability class: Broken Authentication

Published 2026-10-13 · last modified 2026-10-13.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Zarestia-Dev Rclone-Manager — versions < 0.2.7

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

Frequently asked questions

What is CVE-2026-55183?: CVE-2026-55183 is a critical-severity vulnerability in Zarestia-Dev Rclone-Manager, classified under Missing Authentication for Critical Function. CVSS score: 9.6/10. Published 2026-10-13.
How severe is CVE-2026-55183?: Critical severity. CVSS v3 base score is 9.6 out of 10.