CVE-2026-79776 — rclone before 1.75.0 Authentication Bypass via pprof
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/p…
Published: 2026-08-25 · CVSS: 6.9 · CVSS 4.0
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7