CVE-2026-79776: rclone before 1.75.0 Authentication Bypass via pprof
Published Aug 25, 2026
·Updated
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.
Affected Software
1 affected component
Rclone Rclone<1.75.0
Event History
Aug 25, 2026
CVE Published
via MITRE·03:16 PM
Data Sourced
via MITRE·03:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
Deployments running rclone before 1.75.0 are affected when the pprof debug handler is reachable by an attacker. The issue exposes the /debug/pprof/cmdline endpoint without authentication.
2
What can an unauthenticated attacker obtain?
An attacker can retrieve the full rclone process command-line arguments through /debug/pprof/cmdline. Those arguments may include backend credentials.
3
What is the remediation?
Upgrade rclone to version 1.75.0 or later. The vulnerable behavior exists in versions before 1.75.0.