rclone (rc server, /debug/pprof handler): The pprof debug handler is mounted as its own route on the rclone

Impact

The pprof debug handler is mounted as its own route on the rclone remote-control server, outside the fail-closed authentication check that guards everything else. An unauthenticated caller fetches /debug/pprof/cmdline and gets the full argv of the rclone process - which for a data mover means the object-storage access keys, bucket names and endpoints passed on the command line. The same gap also lets an unauthenticated caller enumerate the configured remote names.

Who can reach it

Anyone who can reach the rclone rc port. Data-staging jobs on GPU clusters routinely run rclone with --rc bound to the node interface so a controller can drive it, which puts this in reach of any co-tenant on the cluster network.

What to do

Upgrade rclone to the release carrying this fix and restart the rc server. Independently, stop passing credentials as command-line arguments - move them to the rclone config file or environment - and bind --rc-addr to localhost with --rc-user/--rc-pass set. No CVE ID has been assigned; track it by the GHSA.

References