Quick answers
- Is CVE-2026-79776 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-79776 being exploited in the wild.
- How severe is CVE-2026-79776?
- Medium severity, with a CVSS score of 5.3, published 25 August 2026.
- Which products and versions are affected?
- Rclone before 1.75.0.
- Is there a fix for CVE-2026-79776?
- A patch was published on 2026-08-25: Fixed in rclone 1.75.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-79776 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-79776?
- Check whether you run Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The pprof debug handler is mounted as a separate router route (line 130 in rcserver.go) on the RC server, bypassing the authentication check that lives inside the main s.handler (line 281). This allows unauthenticated access to /debug/pprof/cmdline and related endpoints over the network. The /cmdline endpoint discloses the full process argv, which often contains backend credentials (e.g., S3 access keys) passed via command-line flags or configuration. No authentication or user interaction is required; an attacker with network access to the RC server can immediately retrieve credentials. The vulnerability is fixed in rclone 1.75.0 by moving the authentication check to middleware on the router level.
Affected products
- rclone rclone before 1.75.0
Timeline
- 2026-07-31: disclosed
- 2026-08-25: advisory
- 2026-08-25: patched: Fixed in rclone 1.75.0