CVE-2026-79776
Received Received - Intake

Unauthenticated Debug Endpoint Access in Rclone

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79776
EUVD
EUVD-2026-65534

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rclone rclone to 1.74.4|start_excluding=1.75.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

rclone before 1.75.0 has a vulnerability where the pprof debug handler is mounted as its own route, bypassing authentication. This allows unauthenticated access to the /debug/pprof/cmdline endpoint, which exposes the full process command-line arguments including backend credentials like S3 access keys.

Detection Guidance

Check if rclone versions up to 1.74.4 are running. Inspect network traffic for unauthenticated access to /debug/pprof/cmdline endpoints. Use commands like 'curl http://localhost:5572/debug/pprof/cmdline' to test for exposed process arguments.

Impact Analysis

Attackers can retrieve sensitive backend credentials such as S3 access keys by accessing the debug endpoint without authentication. This could lead to unauthorized access to cloud storage or other backend services configured in rclone.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA, which mandate strict controls over personal and health information access.

Mitigation Strategies

Upgrade rclone to version 1.75.0 or later. Ensure authentication is enforced on all debug endpoints. Disable debug handlers if not needed. Configure TLS for all remote connections to prevent plaintext transmission.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart