# CVE-2026-79776: rclone pprof authentication bypass in RC server

Source: https://junglewise.ai/threats/cve-2026-79776-rclone-pprof-authentication-bypass-in-rc-server  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79776 · Severity: medium · CVSS 5.3 · Published 2026-08-25

rclone is a popular open-source tool for syncing files with cloud storage and managing remote connections. A flaw in versions before 1.75.0 allows unauthenticated attackers on the network to access debugging endpoints that expose sensitive information, including backend storage credentials and full process arguments. This could enable attackers to compromise cloud storage accounts without requiring valid credentials.

Technologies: [Rclone](https://junglewise.ai/threats/technologies/rclone). Vendors: [Rclone](https://junglewise.ai/threats/vendors/rclone).

## Quick answers

**Is CVE-2026-79776 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79776 being exploited in the wild.

**How severe is CVE-2026-79776?** Medium severity, with a CVSS score of 5.3, published 25 August 2026.

**Which products and versions are affected?** Rclone before 1.75.0.

**Is there a fix for CVE-2026-79776?** A patch was published on 2026-08-25: Fixed in rclone 1.75.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79776 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-79776?** Check whether you run Rclone at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The pprof debug handler is mounted as a separate router route (line 130 in rcserver.go) on the RC server, bypassing the authentication check that lives inside the main s.handler (line 281). This allows unauthenticated access to /debug/pprof/cmdline and related endpoints over the network. The /cmdline endpoint discloses the full process argv, which often contains backend credentials (e.g., S3 access keys) passed via command-line flags or configuration. No authentication or user interaction is required; an attacker with network access to the RC server can immediately retrieve credentials. The vulnerability is fixed in rclone 1.75.0 by moving the authentication check to middleware on the router level.

## Affected products

- rclone rclone before 1.75.0

## Timeline

- 2026-07-31: disclosed
- 2026-08-25: advisory
- 2026-08-25: patched: Fixed in rclone 1.75.0

## References

- [https://github.com/rclone/rclone/security/advisories/GHSA-mfvx-7rcj-9m5g](https://github.com/rclone/rclone/security/advisories/GHSA-mfvx-7rcj-9m5g)
- [https://www.vulncheck.com/advisories/rclone-before-authentication-bypass-via-pprof](https://www.vulncheck.com/advisories/rclone-before-authentication-bypass-via-pprof)

## Related threats

- [Rclone B2 backend credential exposure on HTTP redirects](https://junglewise.ai/threats/cve-2026-116196-rclone-before-v1-75-2-contains-a-credential-exposure)
- [Rclone path traversal in translateLink function](https://junglewise.ai/threats/cve-2026-116195-rclone-before-1-75-2-contains-a-path-traversal-vulnerability-in)
- [Rclone cross-site request forgery in pCloud OAuth callback](https://junglewise.ai/threats/cve-2026-116194-rclone-from-1-52-0-before-1-75-2-contains-a-cross-site-request)
- [Rclone serve webdav authentication bypass via OPTIONS requests](https://junglewise.ai/threats/cve-2026-116193-rclone-from-1-64-0-before-1-75-2-contains-an-authentication)
- [rclone server-side request forgery via --rc-serve scheme-relative roots](https://junglewise.ai/threats/cve-2026-116192-rclone-from-1-37-before-1-74-2-contains-a-server-side-request)