CVSS 4.0
5.1 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NCVE-2026-79777
Medium (5.1). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/rclone/rclone 1.75.0.
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.
Severity
CVSS 3.1
2.7 lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWE
- CWE-209
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gwfq-86j8-7qhv | Go | github.com/rclone/rclone | <1.75.0 | 1.75.0 |
| GO-2026-6181 | Go | github.com/rclone/rclone | <1.75.0 | 1.75.0 |