CVE-2026-79776 rclone before 1.75.0 Authentication Bypass via pprof
Attackers can access unauthenticated pprof endpoints in rclone to retrieve process arguments, exposing backend credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-79776?
CVE-2026-79776 is a medium-severity vulnerability in rclone, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.
Weakness: CWE-200
Which versions are affected by CVE-2026-79776?
1 open source package ship an affected version, including rclone.
| Package | Affected | Fixed in |
|---|---|---|
rclone Bitnami | All versions | 1.75.0 |
How do I fix CVE-2026-79776?
Upgrade rclone to 1.75.0 or later.
Is CVE-2026-79776 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79776 exists.
Sources
Also known as BIT-rclone-2026-79776, DEBIAN-CVE-2026-79776, GHSA-mfvx-7rcj-9m5g, GHSA-q353-w8p3-4cjq, MINI-jxmg-mm77-g7r5, MINI-r8v3-4qh3-69w2 and 1 more.