EUVD-2026-65534
GHSA-q353-w8p3-4cjq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:N confirmed by auth bypass; C:H because argv routinely contains full backend credentials, exceeding the VC:L in the provided CVSS 4.0 score; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.
AnalysisAI
Unauthenticated credential exposure in rclone before 1.75.0 allows remote attackers to retrieve backend storage secrets via the pprof debug endpoint, bypassing the main handler's fail-closed authentication entirely. The root cause is architectural: rclone registers Go's net/http/pprof handler on its own separate router route rather than nesting it within the authenticated main handler, so GET /debug/pprof/cmdline returns the full process argv - including cloud backend credentials - to any unauthenticated caller. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The rclone RC (Remote Control) HTTP server must be explicitly enabled at launch - it is off by default and requires the --rc flag or equivalent configuration to be active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) rates confidentiality impact as low, but this metric likely understates real-world severity: the exposed argv can contain cloud-provider credentials, meaning downstream impact on backend storage systems could be severe even though the rclone process itself scores low under the vulnerable-system confidentiality metric. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to a host running rclone's RC server sends an unauthenticated HTTP GET request to http://<target>:<rc-port>/debug/pprof/cmdline. The response body contains the full rclone process argv, including flags such as --s3-access-key-id and --s3-secret-access-key if credentials were supplied on the command line at launch. … |
| Remediation | Upgrade rclone to version 1.75.0 or later, which resolves the authentication bypass by registering the pprof handler within the authenticated main router chain rather than as an independent route. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
PowerShell smart-quote filename injection in rclone's SFTP backend allows an attacker who controls remote filenames to e
An issue was discovered in Rclone before 1.53.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
FTP CRLF injection in rclone before 1.75.0 allows an attacker who can place crafted filenames in a source namespace to i
Cleartext disclosure of AWS STS session tokens affects rclone before 1.74.4 when its S3 backend follows a redirect that
Path traversal in the `rclone serve restic --private-repos` REST server (versions prior to 1.74.4) allows an authenticat
Arbitrary file write via symlink traversal in Rclone prior to 1.74.4 lets an attacker-controlled remote escape the local
In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to t
Denial-of-service vulnerabilities in rclone's archive backend SquashFS parser allow an attacker with write access to rcl
Path traversal in rclone's serve s3 command (versions before 1.74.4) allows unauthenticated remote attackers to both rea
Credential exposure in rclone's WebDAV backend allows an adjacent on-path attacker to capture and replay Basic authentic
Credential exposure in rclone before v1.75.0 allows network-adjacent attackers to capture IBM IAM bearer tokens during s
Rclone before v1.75.0 panics in the WebDAV TUS creation handler when a transport failure returns a nil HTTP response, be
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today