CVE-2026-88044

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/rclone/rclone/commit/739403963abf6f58003c2becd5f7c4ad0d644153
https://github.com/rclone/rclone/releases/tag/v1.75.1
https://github.com/rclone/rclone/security/advisories/GHSA-p569-5gjg-9cmj
https://github.com/rclone/rclone/security/advisories/GHSA-p569-5gjg-9cmj

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-10 17:17

Updated : 2026-09-10 19:54

NVD link : CVE-2026-88044

Mitre link : CVE-2026-88044

CVE.ORG link : CVE-2026-88044

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-88044", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-88044", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-10T17:14:25.073045Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rclone", "product": "rclone", "versions": [{"status": "affected", "version": ">= 1.70.0, < 1.75.1"}]}]}], "published": "2026-09-10T17:17:08.387", "references": [{"url": "https://github.com/rclone/rclone/commit/739403963abf6f58003c2becd5f7c4ad0d644153", "source": "security-advisories@github.com"}, {"url": "https://github.com/rclone/rclone/releases/tag/v1.75.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/rclone/rclone/security/advisories/GHSA-p569-5gjg-9cmj", "source": "security-advisories@github.com"}, {"url": "https://github.com/rclone/rclone/security/advisories/GHSA-p569-5gjg-9cmj", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1."}], "lastModified": "2026-09-10T19:54:25.810", "sourceIdentifier": "security-advisories@github.com"}