What’s Vulnerable › Vulnerabilities

CVE-2026-79783: rclone before 1.74.4 Privilege Escalation via setuid Metadata

• Severity: low (CVSS 3.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-25 · updated 2026-09-10
• Weakness: CWE-732

Description

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root, or to the service account user otherwise.

Affected products

• rclone: before 1.74.4 — fixed in 1.74.4

How to fix

Upgrade to a fixed version: rclone 1.74.4. Check the vendor advisory for mitigations.

References

• https://github.com/rclone/rclone/security/advisories/GHSA-945v-v9p3-v5xw
• https://www.vulncheck.com/advisories/rclone-before-privilege-escalation-via-setuid-metadata
• https://github.com/rclone/rclone/security/advisories/GHSA-945v-v9p3-v5xw

Get alerted when CVE-2026-79783 or the next vulnerability affects your stack