BIT-rclone-2026-79777

vendorUSosv

rclone before v1.75.0 Information Disclosure via RC API

view advisory published 2026-09-25Licence: per source

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-79777US	low2.7	0.30% (23rd)	—	2026-08-25
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutin…

references

External citations — patches, advisories, analysis.

https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhvWEB
https://nvd.nist.gov/vuln/detail/CVE-2026-79777WEB
https://www.vulncheck.com/advisories/rclone-before-information-disclosure-via-rc-apiWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan