rclone: RC per-server auth-proxy bypass

Published September 10, 2026 CVE-2026-88044

A flaw in rclone can bypass authentication on certain FTP services and misroute authenticated S3 users. Exposed services could let someone read, create, change, or delete stored files.

Severity
CriticalCVSS 3.1 · 9.1
Fix
Fixed in 1.75.1Fix recorded today
Affected versions
1.70.0 or newer, but before 1.75.1
Weakness
CWE-863Incorrect Authorization
Exploit likelihood
0.49% in 30 daysEPSS, higher than 41% of known flaws
Affects
Rclone

How it works

  • The issue affects FTP and S3 services started through rclone's remote-control interface with a per-server authentication proxy.
  • The services check the wrong authentication setting and ignore the proxy supplied for that server.
  • FTP then falls back to a fixed storage area with anonymous access, while S3 can send authenticated users to the wrong storage area.
  • Dedicated command-line servers using the global authentication setting are not affected.

What to do

Compare the installed rclone version with 1.70.0 through 1.75.0. Confirm whether FTP or S3 services use the remote-control interface with a per-server authentication proxy.

Upgrade rclone to version 1.75.1.

Technical details

CVE-2026-88044 is an authorization bypass in rclone's remote-control handling of per-server authentication proxies. It occurs when the global proxy setting is empty but an individual server request supplies its own proxy setting.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source