CVE-2026-88017 in Rclone
Summary
by MITRE • 09/10/2026
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the credential or VFS to the authenticated session. If two accepted credentials use the same username but resolve to different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS operations on the first session are reauthorized with the later password. The first session can then read, create, overwrite, rename, or delete objects using the second credential’s backend authority. Exploitation requires the later same-username login to occur while the first session remains open. This issue is fixed in version 1.75.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in rclone versions from 1.64.0 through 1.75.1 represents a critical authentication bypass and authorization flaw within the FTP auth-proxy driver, specifically located in the cmd/serve/ftp/ftp.go module. This component is designed to facilitate file synchronization between local systems and various cloud storage providers by acting as an intermediary proxy. The core technical defect stems from how the server manages user credentials during session establishment. Instead of binding specific authentication tokens or Virtual File System (VFS) contexts directly to individual authenticated sessions, the implementation utilizes a global, server-wide map structure known as userPass that maps usernames to their corresponding obscured passwords. This architectural decision creates a race condition and state management error where the identity of the current active session is not isolated from other concurrent connections sharing the same username identifier.
The operational mechanism of this flaw allows for credential overwriting when multiple sessions authenticate using identical usernames but target different backend storage providers. When an initial client establishes a connection and authenticates with a specific set of credentials, these are stored in the global map under that username key. If a second client subsequently connects using the same username but intends to access a different proxy backend with distinct permissions or targets, its authentication attempt overwrites the existing entry in the userPass map for that username. Consequently, any subsequent file operations performed by the first session, such as reading, creating, overwriting, renaming, or deleting objects, are re-evaluated against the newly overwritten credentials associated with the second client's backend authority. This effectively grants the attacker control over resources they should not have access to, based on the timing of their login relative to legitimate users.
Exploitation of this vulnerability requires precise timing and specific configuration conditions. The attacker must initiate a session using a username that is already in use by another active user or target a backend where such collisions are possible while maintaining an open connection with the first victim's session parameters. Once the second authentication occurs, the state corruption takes effect immediately for all pending operations of the original session. This leads to severe confidentiality and integrity impacts, as sensitive data from one cloud provider can be accessed by users authorized only for a different provider, or files in unauthorized locations may be modified or deleted under the guise of legitimate administrative actions. The lack of session-specific credential binding means that the server fails to enforce proper isolation between distinct authentication contexts sharing an identity label.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-640 Weak Password Storage if the obscured passwords are not sufficiently protected, though the primary issue is authorization logic failure related to session management. In terms of attack vectors, it relates to ATT&CK techniques involving credential access and lateral movement within cloud environments, specifically exploiting misconfigured identity providers or proxy services. The impact extends beyond simple data leakage; it undermines the fundamental trust model of multi-tenant FTP proxies where distinct backend authorities must remain strictly segregated per session regardless of shared username identifiers.
Mitigation strategies primarily involve upgrading to rclone version 1.75.1, which resolves this issue by implementing proper session-bound credential storage and ensuring that VFS contexts are tied directly to the authenticated connection rather than a global user map. For environments where immediate patching is not feasible, administrators should restrict access to the FTP service to trusted networks only and avoid configuring multiple distinct backend proxies under identical username aliases if concurrent sessions are anticipated. Additionally, implementing strict rate limiting on authentication attempts can help mitigate the window of opportunity for such race conditions, although this does not address the root cause within the application logic itself.