rclone EUVD-2026-65535

The RC API must be explicitly enabled via the --rc flag or equivalent configuration - it is not active in default rclone deployments, which substantially limits the attack surface. The attacker must possess valid RC API credentials (PR:H in the CVSS 4.0 vector confirms high-privilege authentication is required). Exploitation is constrained to configurations where the RC API is reachable from attacker-controlled network positions; localhost-only bindings prevent remote exploitation. The partial file read side-channel is limited to the first line that fails INI parsing in a file the attacker can reference via /config/setpath. Deployments that expose the RC API without authentication (contrary to best practice) would reduce the privilege barrier from high to none, significantly increasing exploitability beyond what the CVSS PR:H rating suggests.

The CVSS 4.0 score of 5.1 with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N accurately characterizes this as a bounded, network-reachable information disclosure requiring high privileges. The PR:H rating is the critical limiting factor - the RC API requires authentication by default, confining exploitation to users who already hold RC API credentials or to deployments where the API is misconfigured without authentication. The VC:L rating reflects that disclosed data (paths, versions, memory layout) is secondary intelligence rather than a primary secret. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. There is no CISA KEV listing. The real-world priority is elevated for any organization running rclone with the RC API exposed on a network-accessible interface, particularly where the API lacks authentication or is exposed to untrusted users, because memory address leakage can undermine ASLR mitigations and disclosed module versions can guide targeted CVE chaining. In isolated or localhost-only RC API deployments, risk is substantially lower.

An authenticated RC API user sends a POST to /config/setpath with a non-INI file such as /etc/hostname as the path, then calls /config/dump to trigger a panic in the config parser. The JSON error response body contains the full Go stack trace, including absolute source file paths, third-party dependency versions, goroutine state, memory addresses defeating ASLR, and the first line of the targeted file. A working proof-of-concept using standard curl commands is confirmed in GHSA-gwfq-86j8-7qhv and tested against rclone v1.74.4.