CVE-2026-79777

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-79777", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-25T14:29:43.528Z", "datePublished": "2026-08-25T15:16:07.745Z", "dateUpdated": "2026-08-28T22:25:36.423Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-25T15:16:07.745Z"}, "datePublic": "2026-07-31T00:00:00.000Z", "title": "rclone before v1.75.0 Information Disclosure via RC API", "descriptions": [{"lang": "en", "value": "rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Generation of Error Message Containing Sensitive Information", "cweId": "CWE-209", "type": "CWE"}]}], "affected": [{"vendor": "rclone", "product": "rclone", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/rclone/rclone", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "1.75.0"}, {"version": "1.75.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.75.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW"}}], "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-gwfq-86j8-7qhv)"}, {"name": "VulnCheck Advisory: rclone before v1.75.0 Information Disclosure via RC API", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/rclone-before-information-disclosure-via-rc-api"}], "credits": [{"lang": "en", "value": "SnailSploit", "type": "reporter"}, {"lang": "en", "value": "ncw", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-28T22:25:13.992087Z", "id": "CVE-2026-79777", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-28T22:25:36.423Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-79777", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-28T22:25:13.992087Z"}}}], "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-28T22:25:31.215Z"}}], "cna": {"title": "rclone before v1.75.0 Information Disclosure via RC API", "credits": [{"lang": "en", "type": "reporter", "value": "SnailSploit"}, {"lang": "en", "type": "finder", "value": "ncw"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "rclone", "product": "rclone", "versions": [{"status": "affected", "version": "0", "lessThan": "1.75.0", "versionType": "semver"}, {"status": "unaffected", "version": "1.75.0", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/rclone/rclone", "defaultStatus": "unaffected"}], "datePublic": "2026-07-31T00:00:00.000Z", "references": [{"url": "https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv", "name": "GitHub Security Advisory (GHSA-gwfq-86j8-7qhv)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/rclone-before-information-disclosure-via-rc-api", "name": "VulnCheck Advisory: rclone before v1.75.0 Information Disclosure via RC API", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "Generation of Error Message Containing Sensitive Information"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.75.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-25T15:16:07.745Z"}}}, "cveMetadata": {"cveId": "CVE-2026-79777", "state": "PUBLISHED", "dateUpdated": "2026-08-28T22:25:36.423Z", "dateReserved": "2026-08-25T14:29:43.528Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-25T15:16:07.745Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/rclone/rclone", "product": "rclone", "vendor": "rclone", "versions": [{"lessThan": "1.75.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.75.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses."}], "id": "CVE-2026-79777", "lastModified": "2026-09-10T20:46:19.780", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-79777", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-28T22:25:13.992087Z", "version": "2.0.3"}}]}, "published": "2026-08-25T16:17:29.520", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/rclone-before-information-disclosure-via-rc-api"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/rclone/rclone: rclone: Information Disclosure via RC API error responses", "id": "2523555", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2523555"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-209", "details": ["rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.", "A flaw was found in rclone. Attackers can exploit this vulnerability by triggering panics in the RC API error responses. This can lead to the disclosure of sensitive internal information, such as file paths, module versions, goroutine states, and memory addresses, potentially aiding further attacks."], "mitigation": {"lang": "en:us", "value": "Restrict access to the rclone RC API to trusted networks and administrators only. Use the --rc-allow-origin and --rc-user/--rc-pass flags to enforce authentication. Where possible, disable the RC API entirely if not required for operations."}, "name": "CVE-2026-79777", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Fix deferred", "package_name": "cryostat/cryostat-storage-rhel9", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2026-08-25T15:16:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-79777\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-79777\nhttps://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv\nhttps://www.vulncheck.com/advisories/rclone-before-information-disclosure-via-rc-api"], "statement": "A flaw was found in rclone. The Remote Control (RC) API can include sensitive information such as internal paths, configuration details, or error context in error responses. An authenticated administrator with access to the RC API can observe this information, which may aid in further attacks against the system.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.75.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "rclone", "source": "cna", "vendor": "rclone"}, "product": "rclone", "vendor": "rclone"}], "created": "2026-08-25T17:00:04.118315+00:00", "updated": "2026-08-25T18:00:14.818549+00:00", "vendors": ["rclone", "rclone$PRODUCT$rclone"]}