CVE-2026-79776: Rclone

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.

Affected products

• Rclone Rclone: before 1.75.0 (fixed in 1.75.0)

Published 2026-08-25. Last modified 2026-09-10.