Bug 2523573 (CVE-2026-79776)

Summary: CVE-2026-79776 github.com/rclone/rclone: rclone: Authentication bypass leads to backend credential disclosure
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aazores, cmah, eaguilar, ebaron, gparvin, jmatsuok, jtolenti, pjindal, rhaigner
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in rclone. A remote attacker can bypass the authentication mechanism by accessing the `/debug/pprof/cmdline` endpoint. This vulnerability occurs because the `pprof` debug handler is mounted as its own router route, bypassing the main handler's authentication rule. Successful exploitation allows an unauthenticated attacker to retrieve sensitive backend credentials, leading to information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-25 15:35:09 UTC 
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.