---
id: CVE-2026-79777
title: >-
  rclone before v1.75.0 includes full Go stack traces in RC API error responses
  when panics occur
summary: >-
  rclone before v1.75.0 includes full Go stack traces in RC API error responses
  when panics occur. Attackers can trigger panics to leak internal file paths,
  module versions, goroutine states, and memory addresses.
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-209
vendor: rclone
product: github.com/rclone/rclone
affected:
  - github.com/rclone/rclone < 1.75.0
patched:
  - github.com/rclone/rclone 1.75.0
published: '2026-08-25'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:46:19.780'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79777'
references:
  - url: 'https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/rclone-before-information-disclosure-via-rc-api
    label: disclosure@vulncheck.com
  - url: 'https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://github.com/rclone/rclone/commit/ff43a1e3ae17627c80e523a0ca7445f96516d199
  - url: 'https://github.com/rclone/rclone'
  - url: 'https://github.com/rclone/rclone/releases/tag/v1.75.0'
tags:
  - nvd
  - osv
  - go
epss: 0.00328
epssPercentile: 0.23233
aliases:
  - GHSA-gwfq-86j8-7qhv
  - GO-2026-6181
  - BIT-rclone-2026-79777
ecosystem: go
ingestedAt: '2026-08-27T19:27:46.918Z'
---

## Overview

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-79777)

Affected packages:

- `github.com/rclone/rclone < 1.75.0`

Patched in:

- `github.com/rclone/rclone 1.75.0`

Source: https://osv.dev/vulnerability/GHSA-gwfq-86j8-7qhv