rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

Published September 10, 2026 CVE-2026-88018

rclone's S3 file server can accept requests without proving who sent them. An unauthenticated network attacker can reach the cloud-storage backend selected by its authentication proxy.

Severity
CriticalCVSS 3.1 · 9.8
Fix
Fixed in 1.75.1Fix recorded today
Affected versions
before 1.75.1
Weakness
CWE-287Improper Authentication
Exploit likelihood
0.49% in 30 daysEPSS, higher than 41% of known flaws
Affects
Rclone

How it works

  • The issue affects S3 servers using an authentication proxy without an authentication key.
  • The server accepts a client-chosen access key and checks the request against an empty secret.
  • The proxy then receives that identity and can direct the request to its backend without independently proving who sent it.

What to do

Check the installed rclone version and whether its S3 server uses an authentication proxy without an authentication key. Versions earlier than 1.75.1 match the affected range.

Update rclone to version 1.75.1 or later. Review the rclone security advisory if your deployment cannot update immediately.

Technical details

CVE-2026-88018 is an authentication bypass in rclone serve s3. The affected configuration lets a network attacker choose an access key and reach the backend selected by the authentication proxy.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source