CVE-2026-79783 rclone before 1.74.4 Privilege Escalation via setuid Metadata
Attackers can escalate privileges by planting setuid binaries via untrusted remote metadata when rclone preserves file permissions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-79783?
CVE-2026-79783 is a low-severity vulnerability in rclone, published on 25 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.
Weakness: CWE-732
Which versions are affected by CVE-2026-79783?
4 open source packages ship an affected version, including github.com/rclone/rclone and rclone.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rclone/rclone Go | All versions | 1.74.4 |
github.com/rclone/rclone Go | All versions | 1.74.4 |
github.com/rclone/rclone Go | All versions | 1.74.4 |
rclone Bitnami | All versions | 1.74.4 |
How do I fix CVE-2026-79783?
Upgrade github.com/rclone/rclone to 1.74.4 or later.
Is CVE-2026-79783 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-79783 exists.
Sources
Also known as BIT-rclone-2026-79783, DEBIAN-CVE-2026-79783, GHSA-945v-v9p3-v5xw, GHSA-vqwj-943v-724g, GO-2026-6190, MINI-5vfw-87j7-9gxw and 6 more.