medium5.3
CVE-2026-79776
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler.
Impact
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.
Affected products
| Product | Affected versions |
|---|---|
| Rclone | before 1.75.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.