RClone Manager Local API Flaw Exposes Credentials to Browser Attacks

RClone Manager versions before 0.2.7 contain a critical security flaw that exposes local storage credentials to browser-based attacks. The vulnerability allows unauthorised access to the application's local remote control daemon.

What happened

The NVD record for CVE-2026-55183 describes a weakness in RClone Manager, a cross-platform GUI tool for managing Rclone remotes. According to the advisory, versions prior to 0.2.7 start the local rclone rcd service on 127.0.0.1:51900 with specific flags that disable authentication. The service runs with --rc-no-auth, --rc-allow-origin *, and --rc-serve. This configuration permits any web page opened by the user to send cross-origin requests to the local API.

These requests operate with the user's operating-system privileges. The source material states that this can disclose configured storage credentials. It also notes potential access to upload, modify, or exfiltrate locally stored files and those available through configured remotes. The advisory mentions a possible command-execution impact, but this remains unconfirmed. Version 0.2.7 fixes this issue.

Why it matters

Security teams should note that this flaw turns a local management tool into an attack vector for credential theft. The use of --rc-allow-origin * removes standard browser protections against cross-site request forgery. Any malicious webpage visited while the daemon is running can interact with the local service. This exposes sensitive cloud storage keys and file data to remote attackers. The high severity rating reflects the ease of exploitation via standard web browsing. Environments using older versions are exposed to this risk.

Next steps

• Verify the installed version of RClone Manager on all endpoints.
• Upgrade to version 0.2.7 to apply the vendor's fix.
• Audit local network traffic for unexpected connections to port 51900.
• Rotate any cloud storage credentials that may have been exposed.

Detection notes

Security operations teams usually monitor for unusual local network activity originating from web browsers. Check whether the RClone Manager process initiates outbound connections to localhost ports not typical for standard operations. Look for cross-origin request errors or successful responses from local services in browser console logs. Inspect firewall logs for traffic between the browser and the application's local API port. If unauthorised data exfiltration is suspected, isolate the affected machine immediately. Review file access logs for unexpected modifications or uploads to cloud remotes. Analyse process trees to identify if the local daemon was invoked unexpectedly.

Background: Cross-site request forgery (CSRF)

Protect your application by enforcing strict same-origin policies, validating custom headers on all mutating requests, and ensuring cookies are marked with secure flags. This checklist provides actionable steps to prevent attackers from tricking users into performing unwanted actions on trusted sites.

Read the full guide: Cross-Site Request Forgery Prevention Checklist for Secure Web Apps

What to do and how to stay safe: RClone Manager

• Check all managed devices for RClone Manager versions older than 0.2.7.
• Deploy version 0.2.7 once the vendor provides an update.
• Monitor browser logs for cross-origin requests to local IP addresses.
• Rotate cloud storage credentials if exposure is suspected.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of RClone Manager are affected?

All versions prior to 0.2.7 are affected by this vulnerability.

What is the CVSS score for CVE-2026-55183?

The NVD rates this vulnerability as CVSS 9.6 Critical.

Can attackers execute commands through this flaw?

The advisory notes a possible command-execution impact, but this remains unconfirmed.