THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-gwfq-86j8-7qhv (low) — rclone: Verbose Stack Trace Disclosure in RC API Error Responses

[GHSA] GHSA-gwfq-86j8-7qhv (low) — rclone: Verbose Stack Trace Disclosure in RC API Error Responses

highgithub_advisoriesPublished 2026-08-05

GHSA-gwfq-86j8-7qhv Severity: low CVE: None

rclone: Verbose Stack Trace Disclosure in RC API Error Responses

### Summary

When an RC API call triggers a panic (recovered by the job runner), the full Go stack trace is included in the JSON error response. This leaks internal file paths, Go module versions, goroutine state, and memory addresses to the API caller.

### Details

The panic recovery in

MITRE ATT&CK techniques

VulnerabilitiesT1588.006

Indicators of compromise

ngithub.comdomain
tgithub.comdomain

Original source: https://github.com/advisories/GHSA-gwfq-86j8-7qhv