CVE-2026-79777Low· 2.7▾ Sunlitrclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 14.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/rclone/rclone < 1.75.0Patched in:
github.com/rclone/rclone 1.75.0Connected by shared product, vendor, weakness, or advisory.
GHSA-gwfq-86j8-7qhvLow· 2.7rclone: Verbose Stack Trace Disclosure in RC API Error Responses
GO-2026-6181NoneVerbose stack trace disclosure in RC API error responses in github.com/rclone/rclone
CVE-2026-79779Medium· 5.3rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects
CVE-2026-79780Medium· 5.3rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes
CVE-2026-79778Medium· 5.3rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors
CVE-2026-71309Highrclone is a command-line program to sync files and directories to and from different cloud storage providers