{"id":"CVE-2026-79777","title":"rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur","summary":"rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-209"],"vendor":"rclone","product":"github.com/rclone/rclone","affected":["github.com/rclone/rclone < 1.75.0"],"patched":["github.com/rclone/rclone 1.75.0"],"published":"2026-08-25","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:46:19.780","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79777","references":[{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/rclone-before-information-disclosure-via-rc-api","label":"disclosure@vulncheck.com"},{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/rclone/rclone/commit/ff43a1e3ae17627c80e523a0ca7445f96516d199"},{"url":"https://github.com/rclone/rclone"},{"url":"https://github.com/rclone/rclone/releases/tag/v1.75.0"}],"tags":["nvd","osv","go"],"epss":0.00239,"epssPercentile":0.15213,"aliases":["GHSA-gwfq-86j8-7qhv","GO-2026-6181"],"ecosystem":"go","ingestedAt":"2026-08-27T19:27:46.918Z","slug":"CVE-2026-79777","body":"## Overview\n\nrclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-79777)\n\nAffected packages:\n\n- `github.com/rclone/rclone < 1.75.0`\n\nPatched in:\n\n- `github.com/rclone/rclone 1.75.0`\n\nSource: https://osv.dev/vulnerability/GHSA-gwfq-86j8-7qhv","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}