CVE-2026-88044 in Rclone
Summary
by MITRE • 09/10/2026
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within rclone versions ranging from 1.70.0 to 1.75.1 represents a critical logic error in how authentication proxy configurations are processed for remote command interfaces, specifically affecting the FTP and S3 serving capabilities. Rclone is widely utilized as a command-line synchronization tool that facilitates data transfer between various cloud storage providers and local file systems. The flaw resides within the serve and start Remote Control (RC) interface implementations, where the software fails to correctly isolate per-server configuration settings from global process-level variables. This architectural oversight leads to a scenario where request-local authentication proxy options are inadvertently ignored in favor of checking a static, process-global proxy option value.
In technical terms, the defect is located within the constructors for FTP and S3 services found in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go respectively. When these servers initialize, they are intended to respect specific authentication proxies defined for that particular server instance via AuthProxy settings. However, due to the incorrect reference to the global proxy.Opt.AuthProxy variable instead of the request-local configuration, the application fails to apply the correct security context. This misconfiguration results in a fallback behavior when the global option is empty or not explicitly set by an administrator prior to service initiation. The impact manifests differently depending on the protocol being served, leading to significant authentication bypasses and unauthorized access scenarios.
For FTP servers operating under this vulnerable configuration, the failure to apply the intended proxy settings causes the system to revert to a default fixed filesystem implementation. In this state, the server accepts connections using anonymous login credentials with any provided password string. This effectively disables required authentication mechanisms, allowing unauthenticated users to browse and potentially download or upload files depending on underlying file permissions. For S3 servers configured with AuthKey authentication, the flaw causes the service to serve a fixed Remote Control filesystem rather than the specific backend storage intended by the proxy configuration. This exposes internal management interfaces and data structures that should remain isolated from external clients, creating a severe information disclosure risk and potential for remote code execution if combined with other vulnerabilities in the RC interface.
The operational impact of this vulnerability is substantial, particularly in environments where rclone serves as an API gateway or file sharing endpoint over FTP or S3 protocols. Attackers can exploit this logic error to bypass authentication controls entirely on FTP endpoints, gaining access to sensitive data without valid credentials. On S3 endpoints, the exposure of the fixed RC filesystem allows attackers to interact with internal remote control commands that are not meant for public consumption. This could lead to further exploitation vectors such as arbitrary file reads or writes if additional permissions allow it. It is important to note that dedicated command-line servers which explicitly configure the global option via command-line arguments are not affected by this specific flaw, as they bypass the default initialization path where the bug resides.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-940 Improper Verification of AuthBypass in Software Components. The failure to correctly apply per-request security configurations maps directly to these categories, representing a classic case of configuration state leakage across request boundaries. In the context of the MITRE ATT&CK framework, this vulnerability facilitates Initial Access through T1078 Valid Accounts if an attacker can guess or brute-force anonymous credentials on FTP, and potentially Reconnaissance via T1046 Network Service Discovery by exposing internal RC endpoints over S3 that reveal system architecture details.
Mitigation for organizations utilizing affected versions of rclone involves immediate upgrading to version 1.75.1 or later, where the logic has been corrected to properly scope authentication proxy settings to individual server instances rather than relying on global state. For environments unable to upgrade immediately, administrators should ensure that the process-global proxy option is explicitly configured with valid credentials before starting any FTP or S3 serve commands, although this approach reduces flexibility and increases operational complexity by tying all servers in a single process to identical authentication proxies. Additionally, network-level controls such as firewalls restricting access to ports 21 for FTP and 9000 (or the designated RC port) can help limit exposure until patches are applied. Regular auditing of rclone configurations is recommended to ensure that no legacy instances remain running with vulnerable code paths enabled in production environments.