CVE-2026-79777: rclone Information Disclosure Vulnerability

CVE-2026-79777 Overview

CVE-2026-79777 affects rclone versions prior to v1.75.0. The remote control (RC) API returns full Go stack traces in error responses when a panic occurs. Authenticated attackers can deliberately trigger panics to extract sensitive runtime information from the server process.

Leaked data includes internal file paths, Go module versions, goroutine states, and raw memory addresses. This information supports reconnaissance, fingerprinting of the deployment, and preparation of follow-on attacks. The weakness is categorized as CWE-209: Generation of Error Message Containing Sensitive Information.

Critical Impact
Authenticated attackers can leak internal file paths, memory addresses, and Go runtime state through crafted RC API requests that trigger panics.

Affected Products

rclone versions prior to v1.75.0
Deployments exposing the rclone remote control (RC) API
Environments running rclone as a service or daemon with --rc enabled

Discovery Timeline

2026-08-25 - CVE-2026-79777 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79777

Vulnerability Analysis

rclone exposes a remote control API for programmatic operations against configured remotes. When a handler in this API panics, the runtime writes the full Go stack trace back to the HTTP response body instead of a sanitized error.

An authenticated caller who can reach the RC endpoint can craft input that forces a panic. The response then discloses process internals, including function names, source file paths on the build host, goroutine identifiers, and pointer values. These artifacts allow attackers to map the binary, identify vulnerable module versions, and correlate memory layouts across requests.

The issue is a verbose error handling flaw rather than a memory safety bug. Exploitation requires network access to the RC listener and valid credentials, which limits pre-auth exposure but remains relevant in multi-tenant or shared-service deployments.

Root Cause

The RC API error path serializes the raw panic value and stack trace produced by the Go runtime. No filtering strips build paths, module versions, goroutine dumps, or address values before the response is written. This aligns with CWE-209, where diagnostic detail intended for developers reaches an untrusted client.

Attack Vector

Exploitation requires network reachability to the rclone RC API and a valid authenticated session. The attacker sends RC requests with parameters designed to reach a panicking code path. The server returns an HTTP error response whose body contains the full Go stack trace, and the attacker parses it for internal filesystem layout, dependency versions, and memory addresses.

For technical details, refer to the GitHub Security Advisory GHSA-gwfq-86j8-7qhv and the VulnCheck advisory on rclone.

Detection Methods for CVE-2026-79777

Indicators of Compromise

RC API responses containing the substring goroutine or runtime/panic.go returned to remote clients.
HTTP 5xx responses from the rclone RC endpoint with unusually large bodies containing Go source file paths.
Repeated authenticated requests to a single RC method with malformed or boundary-value parameters.

Detection Strategies

Inspect rclone process logs and reverse proxy logs for panic markers such as panic: and goroutine N [running]: in outbound responses.
Alert on error responses from /rc/ endpoints whose response body size exceeds a baseline for normal errors.
Correlate authentication events with clusters of RC error responses from the same session or source address.

Monitoring Recommendations

Log all RC API access with method, status code, and response size for behavioral baselining.
Monitor rclone binary version across hosts and flag anything below v1.75.0.
Track outbound egress from rclone hosts for unexpected fingerprinting patterns following authenticated RC access.

How to Mitigate CVE-2026-79777

Immediate Actions Required

Upgrade rclone to version v1.75.0 or later on all systems running the RC API.
Restrict RC API network exposure to trusted management networks or loopback only.
Rotate RC API credentials if unauthorized authenticated access is suspected.
Audit historical RC responses in logs for leaked paths, module versions, or addresses that may aid an attacker.

Patch Information

The fix ships in rclone v1.75.0. The upstream project sanitizes RC API error responses so panic details are no longer returned to callers. Refer to the GitHub Security Advisory GHSA-gwfq-86j8-7qhv for release notes and remediation guidance.

Workarounds

Bind the RC listener to 127.0.0.1 and require an authenticated reverse proxy or SSH tunnel for access.
Place the RC endpoint behind a web application firewall configured to strip response bodies on 5xx status codes.
Disable the RC API entirely on hosts that do not require programmatic control by removing the --rc flag.
Enforce least privilege on RC user accounts and disable unused RC methods via --rc-no-auth restrictions and explicit allowlists.

bash

# Configuration example: restrict rclone RC API to localhost with authentication
rclone rcd \
  --rc-addr 127.0.0.1:5572 \
  --rc-user admin \
  --rc-pass "$(cat /etc/rclone/rc.pass)" \
  --rc-serve=false