Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck
CVE-2026-79777rclone before v1.75.0 Information Disclosure via RC API
Low 2.7
In plain English
A low-severity security flaw in rclone from rclone. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.3%top 77.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rclone | no fix listed | DEBIAN-CVE-2026-79777 |
| Debian:13 | rclone | no fix listed | DEBIAN-CVE-2026-79777 |
| Go | github.com/rclone/rclone | 1.75.0 | GHSA-gwfq-86j8-7qhv |
| Go | github.com/rclone/rclone | 1.75.0 | GO-2026-6181 |
| Ubuntu:26.10 | rclone | no fix listed | UBUNTU-CVE-2026-79777 |
Affected products (as reported)
Weakness: CWE-209 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-gwfq-86j8-7qhv) vendor-advisory
- VulnCheck Advisory: rclone before v1.75.0 Information Disclosure via RC API third-party-advisory