CVE-2026-79777 in Rclone
Summary
by MITRE • 08/25/2026
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in rclone prior to version 1.75.0 represents a significant information disclosure flaw within the Remote Control API interface. This issue stems from inadequate error handling mechanisms when runtime panics occur during request processing. In Go-based applications, unhandled panics typically result in the printing of full stack traces to standard output or error streams. When this behavior is exposed through an accessible network service like the RC API without proper sanitization, it allows external actors to retrieve sensitive internal application details that were not intended for public consumption.
The technical root cause lies in the absence of a robust panic recovery mechanism within the HTTP handlers serving the Remote Control interface. Normally, Go applications should implement deferred functions to recover from panics and return controlled error messages to clients. In this case, when an attacker triggers conditions that lead to a nil pointer dereference, array index out of bounds, or other runtime errors, the application fails to catch these exceptions gracefully. Instead, it propagates the raw stack trace directly into the HTTP response body sent back to the requester. This behavior effectively turns any unhandled exception in the RC API endpoint into an information leakage vector.
The operational impact of this vulnerability is substantial due to the depth of information contained within Go stack traces. These traces reveal internal file paths, which can expose directory structures and configuration locations on the host system. They also disclose module versions, providing attackers with precise knowledge of the software dependencies in use, including potentially vulnerable third-party libraries. Furthermore, goroutine states and memory addresses are exposed, offering insights into the application's concurrency model and runtime environment. This level of detail significantly aids adversaries in crafting more targeted exploits or understanding the internal architecture for further reconnaissance activities.
From a classification perspective, this vulnerability aligns with CWE-209: Generation of Error Message Containing Sensitive Information. It also relates to CWE-754: Improper Check for Unusual or Exceptional Conditions, as the application fails to properly handle exceptional runtime states. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates Discovery techniques under Tactic TA0007, specifically aiding in System Information Discovery and Application Window Discovery through stack trace analysis. The exposure aids attackers in mapping out the attack surface more effectively than would be possible with generic error messages.
Mitigation strategies primarily involve upgrading to rclone version 1.75.0 or later, where this issue has been addressed by implementing proper panic recovery logic within the RC API handlers. For environments unable to upgrade immediately, administrators should restrict access to the Remote Control interface using network-level controls such as firewalls or reverse proxies that limit exposure to trusted IP addresses only. Additionally, deploying a Web Application Firewall with rules designed to detect and block responses containing stack trace patterns can provide an additional layer of defense against exploitation attempts aimed at harvesting internal system details.