GHSA-gwfq-86j8-7qhv: rclone: Verbose Stack Trace Disclosure in RC API Error Responses

August 5, 2026

When an RC API call triggers a panic (recovered by the job runner), the full Go stack trace is included in the JSON error response. This leaks internal file paths, Go module versions, goroutine state, and memory addresses to the API caller.

References

github.com/advisories/GHSA-gwfq-86j8-7qhv
github.com/rclone/rclone/commit/ff43a1e3ae17627c80e523a0ca7445f96516d199
github.com/rclone/rclone/releases/tag/v1.75.0
github.com/rclone/rclone/security/advisories/GHSA-gwfq-86j8-7qhv

Code Behaviors & Features

Detect and mitigate GHSA-gwfq-86j8-7qhv with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →