CVE-2026-79783
Description
A flaw was found in rclone. This vulnerability allows a remote attacker to escalate privileges by manipulating file metadata. When copying files with metadata preservation from an untrusted source, rclone fails to properly mask special permission bits. This oversight enables an attacker to set setuid or setgid bits on their controlled files, potentially leading to privilege escalation to root or the service account user if rclone is running with elevated permissions.
Statement
A flaw was found in rclone. When syncing files, rclone preserves setuid and setgid metadata bits from the source. An attacker who controls the source of a sync operation can craft files with setuid/setgid bits set, which when synced to the destination may result in privilege escalation if the synced files are subsequently executed.
Mitigation
Use rclone with the --no-update-modtime flag or explicitly strip setuid/setgid bits after syncing files from untrusted sources. Avoid syncing executable files from untrusted remotes to locations where they may be executed by privileged users.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.6 | N/A | 3.6 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
