rclone: FTP cross-session auth-proxy backend confusion

Published September 10, 2026 CVE-2026-88017

rclone's FTP service can let one valid login access objects exposed by another accepted credential's backend. That access can include reading, changing, or deleting data.

Severity
HighCVSS 3.1 · 7.3
Fix
Fixed in 1.75.1Fix recorded today
Affected versions
1.64.0 or newer, but before 1.75.1
Weakness
CWE-488
Exploit likelihood
0.23% in 30 daysEPSS, higher than 14% of known flaws
Affects
Rclone

How it works

  • The issue affects FTP services using an authentication proxy that accepts different credentials for one username.
  • A later login using another accepted credential can replace the credential tied to the earlier open session.
  • Later FTP operations in that first session then use the newer credential's backend.
  • The attacker needs a valid credential and must keep the first session open.

What to do

Check the rclone version used by each FTP service with --auth-proxy, then compare it with the affected range in the advisory. Exposure also requires different accepted credentials for the same username to reach different backends.

Update rclone to version 1.75.1. Confirm that each FTP service is running the updated release.

Technical details

CVE-2026-88017 affects rclone's FTP auth-proxy driver from 1.64.0 through 1.75.0. The driver stored one credential per username across the service instead of binding it to the FTP session, so a later same-username login could redirect the earlier session to another backend. The issue is fixed in 1.75.1.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction Required Requires another user to take an action
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source