rclone prior to 1.75.0 was mounting the pprof debug handler as a separate router route, which unintentionally bypassed the main handler’s fail‑closed authentication rule; as a result, an attacker could access the /debug/pprof/cmdline endpoint without authentication and retrieve the full process command line, exposing backend credentials and other sensitive data. This flaw represents a combination of sensitive data exposure (CWE-200) and authentication bypass (CWE-305).

The vulnerability affects all installations of the rclone product from any release older than 1.75.0; no specific vendor or product version list is provided beyond the general "before 1.75.0" notation, so any host running rclone earlier than that version is potentially impacted.

The CVSS score of 6.9 classifies the issue as moderate severity, and the EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation; it is not listed in the CISA KEV catalog; the attack requires network access to the rclone instance and the ability to issue an HTTP request to the exposed /debug/pprof/cmdline endpoint, which, if the service is reachable from an attacker’s network or the same host, allows them to retrieve credentials without any authentication.