CVE-2026-79783 in Rclone
Summary
by MITRE • 08/25/2026
rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in versions of rclone prior to 1.74.4 represents a critical security flaw within the local backend implementation regarding file permission handling. Specifically, when the application is instructed to preserve metadata from source files during copy operations, it fails to properly mask or strip special Unix permission bits such as setuid and setgid before applying them to destination files on the local filesystem. This oversight allows an attacker who controls the source of a transfer to dictate these high-privilege attributes on the resulting files in the target directory. The core technical failure lies in the lack of sanitization for mode metadata, where the application blindly trusts and applies the permission bits provided by the untrusted remote without filtering out dangerous special flags that could alter execution behavior or access control lists beyond standard user permissions.
The operational impact of this vulnerability is severe, particularly in environments where rclone is executed with elevated privileges such as root or a dedicated service account with broad filesystem write access. If an attacker can supply a malicious binary file from an untrusted remote source and trigger a metadata-preserving copy operation while the tool runs as root, they can effectively plant a setuid executable on the local system. When this planted binary is subsequently executed by any user, it will run with the privileges of its owner, which in this scenario would be root due to the rclone process running as root during the copy. This results in an immediate and direct privilege escalation from unprivileged user context to full administrative control over the host system. Even if rclone does not run as root but rather under a specific service account with significant permissions, the attacker can escalate privileges to that service account's level, potentially compromising sensitive data or lateral movement capabilities within the infrastructure.
This flaw aligns closely with CWE-250, which describes execution with unnecessary privileges, and CWE-732, concerning incorrect permission assignment for critical resources. The attack vector is consistent with ATT&CK technique T1496, Resource Hijacking, where an adversary uses system resources to gain persistence or privilege escalation, specifically through the manipulation of file attributes to enable unauthorized code execution at higher privilege levels. It also relates to CWE-284, Improper Access Control, as the vulnerability allows actors to bypass intended restrictions on who can execute files with elevated privileges by manipulating the underlying filesystem metadata.
To mitigate this risk, organizations must immediately upgrade rclone to version 1.74.4 or later, where the developers have implemented proper masking of special permission bits during local backend operations. In environments where upgrading is not instantly feasible, administrators should avoid using the --metadata flag with untrusted remote sources when running rclone as root or a high-privilege service account. Additionally, implementing strict file integrity monitoring and restricting the execution permissions on directories used for temporary storage can help limit the blast radius if such files are inadvertently created. Security teams should also audit existing cron jobs or automated scripts that utilize rclone to ensure they adhere to the principle of least privilege, avoiding root access unless absolutely necessary for other operational requirements.