Executive brief
rclone is a popular command-line tool for syncing files with cloud storage and managing remote filesystems. When the RC (Remote Control) API encounters errors, it can inadvertently expose detailed internal system information—including file paths, Go module versions, and memory addresses—to anyone with API access. An attacker with high privileges to the RC API can trigger these errors deliberately to leak sensitive debugging information that aids in further attacks.
Technical details
The vulnerability is an information disclosure flaw (CWE-209) in rclone's RC API error handling. When the RC API function runner catches a panic (in fs/rc/jobs/job.go:110-115), it captures the full output of Go's debug.Stack() and includes it verbatim in the JSON HTTP error response. This exposes file paths, Go runtime/module versions, goroutine IDs, memory addresses (ASLR leaks), and partial file contents to the API caller. An authenticated attacker with high privileges can trigger panics by sending malformed API requests (e.g., setting a config path to a non-INI file and calling dump). The vulnerability affects all rclone versions through v1.74.4 and is patched in v1.75.0 by returning generic error messages and logging full traces server-side only. Attack vector is network; no user interaction required.
Affected products
- rclone rclone before 1.75.0
Timeline
- 2026-07-31: disclosed
- 2026-08-25: advisory
- 2026-08-25: patched: v1.75.0 released