Information Disclosure Vulnerability in rclone by Rclone, Inc.

CVE-2026-79777

What is CVE-2026-79777?

Versions of rclone prior to 1.75.0 are susceptible to an information disclosure vulnerability through its RC API. When a panic occurs within the application, detailed Go stack traces are returned in the error responses. This can be exploited by attackers to gain insights into sensitive internal file paths, module versions, goroutine states, and memory addresses, potentially leading to unauthorized access or further exploitation of the system. It is crucial for users of affected versions to upgrade to mitigate the risk.

References