rclone verbose stack trace disclosure in RC API

Executive brief

rclone is a command-line program used to manage files on cloud storage. A vulnerability in its remote control API allows authenticated users to view detailed system information, including internal file paths and memory addresses, when an error occurs. This information could be used by a sophisticated attacker to better understand the system's internal structure and facilitate further attacks.

Technical details

The vulnerability is a sensitive information disclosure (CWE-209) within the rclone Remote Control (RC) API. When a job triggers a Go panic, the recovery mechanism in `fs/rc/jobs/job.go` captures the full output of `debug.Stack()` and includes it in the `Error` field of the JSON response. An authenticated attacker can trigger this by providing malformed configuration paths or other inputs that cause a runtime panic. The resulting stack trace leaks internal filesystem paths, Go module versions, goroutine states, and memory addresses (potentially bypassing ASLR). Additionally, the error message may leak the first line of non-INI files if a parse error is triggered. The issue is fixed in version 1.75.0 by stripping stack traces from API responses.

Affected products

• rclone rclone <= 1.74.4

Timeline

• 2026-07-31: disclosed
• 2026-08-05: advisory
• 2026-08-05: patched: Fixed in version 1.75.0

References

• https://api.github.com/users/SnailSploit
• https://github.com/SnailSploit
• https://api.github.com/users/SnailSploit/gists%7B/gist_id%7D
• https://api.github.com/users/SnailSploit/repos
• https://avatars.githubusercontent.com/u/95986478?v=4
• https://api.github.com/users/SnailSploit/events%7B/privacy%7D