rclone EUVD-2026-65534

The rclone RC (Remote Control) HTTP server must be explicitly enabled at launch - it is off by default and requires the --rc flag or equivalent configuration to be active. The RC port must be network-reachable by the attacker; the CVSS 4.0 AV:N metric confirms this is a network-accessible endpoint. No authentication is required against the pprof endpoint itself - this authentication bypass is the core vulnerability, meaning even RC servers explicitly configured to require credentials are bypassed on the /debug/pprof/cmdline path. Credential exposure is contingent on secrets being passed as CLI arguments rather than via environment variables, configuration files, or system keystores, since only argv values appear in the cmdline endpoint response. Exploitation does not apply to rclone used as a CLI sync tool without the RC server enabled.

The provided CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) rates confidentiality impact as low, but this metric likely understates real-world severity: the exposed argv can contain cloud-provider credentials, meaning downstream impact on backend storage systems could be severe even though the rclone process itself scores low under the vulnerable-system confidentiality metric. This is a signal conflict worth noting - VC:L versus practical credential-theft impact - and defenders should weight actual data sensitivity over the raw score. EPSS data was not provided in available intelligence, so probabilistic exploitation frequency cannot be quantified. No CISA KEV listing was identified, and no POC code is confirmed at time of analysis. The primary risk limiter is deployment posture: rclone does not enable its RC server by default, so only instances explicitly launched with RC enabled and network-exposed are vulnerable. Organizations running rclone in CI/CD or automation pipelines with CLI-embedded credentials and an externally reachable RC port face the highest practical risk. CVSS AV:N/AC:L/PR:N/UI:N signals are consistent with the description - once the RC server is reachable, exploitation is trivially one HTTP GET with no authentication or user interaction required.

An attacker with network access to a host running rclone's RC server sends an unauthenticated HTTP GET request to http://<target>:<rc-port>/debug/pprof/cmdline. The response body contains the full rclone process argv, including flags such as --s3-access-key-id and --s3-secret-access-key if credentials were supplied on the command line at launch. The attacker extracts these credentials and authenticates directly to the configured cloud storage backend to exfiltrate, modify, or delete stored data.