rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. (CVE-2026-79776)

The vulnerability in rclone prior to version 1.75.0 involves the pprof debug handler being mounted separately from the main router, which enforces a fail-closed authentication rule. Because of this separate mounting, the /debug/pprof/cmdline endpoint can be accessed without authentication. This endpoint exposes the full process argv, potentially leaking sensitive backend credentials embedded in command line arguments. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact.

An attacker can remotely access the /debug/pprof/cmdline endpoint without authentication, allowing them to retrieve the full command line arguments of the rclone process. This may expose sensitive backend credentials contained in those arguments, leading to potential credential disclosure. There is no impact on integrity or availability reported.

A fix is available in rclone version 1.75.0 and later. Users should upgrade to version 1.75.0 or newer to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.