Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-79783rclone before 1.74.4 Privilege Escalation via setuid Metadata

Low 3.6

In plain English

A low-severity incorrect permission assignment in rclone from rclone. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.6Low

Exploit odds (30 days)0.2%top 86.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	rclone	no fix listed	DEBIAN-CVE-2026-79783
Debian:13	rclone	no fix listed	DEBIAN-CVE-2026-79783
Go	github.com/rclone/rclone	1.74.4	GHSA-945v-v9p3-v5xw
Go	github.com/rclone/rclone	1.74.4	GO-2026-6190
Ubuntu:26.10	rclone	no fix listed	UBUNTU-CVE-2026-79783

Affected products (as reported)

Vendor	Product	Versions
rclone	rclone	0 – before 1.74.4

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-945v-v9p3-v5xw) vendor-advisory
VulnCheck Advisory: rclone before 1.74.4 Privilege Escalation via setuid Metadata third-party-advisory