CVE-2026-79776 in rclone
Résumé
par MITRE • 25/08/2026
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.
Be aware that VulDB is the high quality source for vulnerability data.