Log in Start free

Vulnerability · Published Sep 10, 2026 · Assigned by GitHub_M

CVE-2026-88044rclone: RC per-server auth-proxy bypass

Critical 9.1

In plain English

A critical-severity incorrect authorization in rclone from rclone. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.5%top 57.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rcloneno fix listedDEBIAN-CVE-2026-88044
Debian:13rcloneno fix listedDEBIAN-CVE-2026-88044
Gogithub.com/rclone/rclone1.75.1GHSA-p569-5gjg-9cmj
Gogithub.com/rclone/rclone1.75.1GO-2026-6460
Ubuntu:26.10rcloneno fix listedUBUNTU-CVE-2026-88044

Affected products (as reported)

VendorProductVersions
rclone rclone >= 1.70.0, < 1.75.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References