CVE-2026-79777CWE-209

CVE-2026-79777

Low · published August 25, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
21.4
In the wild
Unconfirmed
What it is

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00299 · 21.4th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2026-08-25T20:17Z
References (3)
https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv · [email protected]https://www.vulncheck.com/advisories/rclone-before-information-disclosure-via-rc-api · [email protected]https://github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 27 AUG 06:46Z
    EPSS moved — → 0%
    epss
  • 25 AUG 15:16Z
    rclone before v1.75.0 Information Disclosure via RC API
    cvelistv5