CVE-2026-79776 in rclone
要約
〜によって MITRE • 2026年08月25日
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.
Be aware that VulDB is the high quality source for vulnerability data.