CVE-2026-79776: rclone Information Disclosure Vulnerability

CVE-2026-79776 Overview

CVE-2026-79776 is an authentication bypass vulnerability in rclone versions before 1.75.0. The flaw stems from the pprof debug handler being mounted as its own router route, bypassing the fail-closed authentication rule applied to the main handler. Unauthenticated network attackers can reach the /debug/pprof/cmdline endpoint and retrieve the full process argument vector. Because rclone commonly receives backend credentials via command-line flags, the exposed argv may include access keys, tokens, and passwords for cloud storage providers. The issue is tracked as an information exposure weakness [CWE-200].

Critical Impact
Unauthenticated attackers with network access to the rclone remote control interface can retrieve backend credentials embedded in process arguments.

Affected Products

rclone versions prior to 1.75.0
rclone deployments exposing the remote control (rcd) or HTTP-based command interface
Downstream integrations relying on rclone's rc HTTP API with authentication configured

Discovery Timeline

2026-08-25 - CVE-2026-79776 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79776

Vulnerability Analysis

rclone exposes an HTTP-based remote control interface used to drive operations programmatically. The main handler enforces a fail-closed authentication check, rejecting requests that lack valid credentials. The pprof profiling handler, however, is registered as an independent route on the HTTP router. This registration path skips the authentication middleware applied to the primary handler chain. As a result, requests to /debug/pprof/* reach the profiling handlers without any credential check.

The /debug/pprof/cmdline endpoint returns the full command line of the running process. rclone users routinely pass backend credentials, such as S3 access keys, Azure account keys, and WebDAV passwords, as CLI flags to rclone invocations. Retrieving argv therefore discloses cloud storage credentials in cleartext to any unauthenticated network client. This maps to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Root Cause

The root cause is inconsistent middleware application across router routes. The pprof handler is attached directly to the mux rather than wrapped by the authentication middleware protecting the main handler. This architectural gap means the fail-closed rule intended to gate the entire interface applies only to the primary route.

Attack Vector

Exploitation requires only network reachability to the rclone remote control listener. The attacker issues an unauthenticated HTTP GET request to /debug/pprof/cmdline and receives the process argument vector in the response body. No user interaction, privileges, or session state are required. Details are documented in the GitHub Security Advisory and the VulnCheck Advisory on Rclone.

// No verified exploit code is available. The vulnerability is triggered by an
// unauthenticated HTTP request to the /debug/pprof/cmdline path on the rclone
// remote control listener. See the linked advisories for further detail.

Detection Methods for CVE-2026-79776

Indicators of Compromise

Unauthenticated HTTP requests to /debug/pprof/cmdline, /debug/pprof/heap, or other /debug/pprof/* paths in rclone access logs
HTTP 200 responses from /debug/pprof/* endpoints originating from untrusted source IP addresses
rclone process invocations with credentials passed as inline CLI flags rather than via config files or environment variables

Detection Strategies

Inventory hosts running rclone and identify versions below 1.75.0 that expose the rc HTTP interface
Alert on any external or unexpected internal access to rclone remote control ports, particularly requests targeting /debug/pprof/
Correlate rclone HTTP access with subsequent anomalous cloud storage API activity that could indicate credential reuse

Monitoring Recommendations

Enable rclone HTTP access logging and forward events to a centralized log platform for retention and search
Baseline expected clients of the rclone rc endpoint and generate alerts on deviations
Monitor cloud provider audit logs for API calls from unfamiliar IP addresses using rclone-associated credentials

How to Mitigate CVE-2026-79776

Immediate Actions Required

Upgrade rclone to version 1.75.0 or later on all systems running the remote control interface
Rotate any backend credentials that may have been passed as CLI arguments to affected rclone processes
Restrict network access to the rclone rc listener using firewall rules or bind it to localhost only

Patch Information

The issue is fixed in rclone 1.75.0. The fix ensures the pprof debug handler is subject to the same authentication middleware as the main handler. Refer to the GitHub Security Advisory GHSA-mfvx-7rcj-9m5g for the authoritative patch reference.

Workarounds

Bind the rclone remote control interface to a loopback address using --rc-addr 127.0.0.1:5572 where remote access is not required
Place the rclone rc endpoint behind a reverse proxy that enforces authentication and blocks /debug/pprof/ paths
Provide credentials via rclone configuration files or environment variables instead of command-line flags to reduce exposure through argv

bash

# Configuration example: block pprof paths at a reverse proxy (nginx)
location /debug/pprof/ {
    deny all;
    return 404;
}

location / {
    proxy_pass http://127.0.0.1:5572;
    auth_basic "rclone rc";
    auth_basic_user_file /etc/nginx/.htpasswd;
}