https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:44:07.520499+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-rclone-2026-79776 BIT-rclone-2026-79776 — rclone before 1.75.0 Authentication Bypass via pprof 2026-10-02T10:44:07.524043+00:00

Affected: Bitnami: rclone

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.

 https://cve.radiocsirt.org/vuln/euvd-2026-358866 EUVD-2026-358866 2026-10-02T10:44:07.524090+00:00 EUVD-2026-358866 https://cve.radiocsirt.org/vuln/fkie_cve-2026-79776 fkie_cve-2026-79776 2026-10-02T10:44:07.524106+00:00

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.

 https://cve.radiocsirt.org/vuln/ghsa-q353-w8p3-4cjq GHSA-q353-w8p3-4cjq 2026-10-02T10:44:07.524129+00:00

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-79776 UBUNTU-CVE-2026-79776 2026-10-02T10:44:07.524144+00:00

Affected: Ubuntu:18.04:LTS: rclone, Ubuntu:Pro:20.04:LTS: rclone, Ubuntu:Pro:22.04:LTS: rclone, Ubuntu:Pro:24.04:LTS: rclone, Ubuntu:Pro:26.04:LTS: rclone

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2623 WID-SEC-W-2026-2623 — rclone: Mehrere Schwachstellen 2026-10-02T10:44:07.524168+00:00

Ein Angreifer kann mehrere Schwachstellen in rclone ausnutzen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um beliebigen Programmcode auszuführen.