CVE-2026-79777: rclone before v1.75.0 Information Disclosure via RC API
Published Aug 25, 2026
·Updated
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.
Affected Software
1 affected component
Rclone Rclone<v1.75.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rcloneto a version that resolves this vulnerability.Fixed in 1.75.0
Event History
Aug 25, 2026
CVE Published
via MITRE·03:16 PM
Data Sourced
via MITRE·03:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Deployments running rclone before v1.75.0 with the RC API reachable by an attacker are exposed. Exploitation also requires high privileges, as reflected by the PR:H vector.
2
What information can be disclosed if exploitation succeeds?
RC API error responses may expose full Go stack traces, including internal file paths, module versions, goroutine states, and memory addresses.
3
How can this be remediated?
Upgrade rclone to v1.75.0 or later.