CVE-2026-88017: rclone: FTP cross-session auth-proxy backend confusion
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the credential or VFS to the authenticated session. If two accepted credentials use the same username but resolve to different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS operations on the first session are reauthorized with the later password. The first session can then read, create, overwrite, rename, or delete objects using the second credential’s backend authority. Exploitation requires the later same-username login to occur while the first session remains open. This issue is fixed in version 1.75.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rclone FTP auth-proxy driver (cmd/serve/ftp/ftp.go)to a version that resolves this vulnerability.Fixed in 1.75.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using rclone's FTP auth-proxy driver are affected in versions from 1.64.0 up to, but not including, 1.75.1. Exposure requires accepted credentials that share a username while resolving to different proxy backends.
What must an attacker do to exploit the confusion?
The attacker needs a later successful login using the same username as an existing open session, but with credentials that resolve to a different proxy backend. That later login must occur before the first session closes.
What access can the affected first session gain?
After the later login overwrites the server-wide password entry, the first session can be reauthorized against the later credential's backend. It can then read, create, overwrite, rename, or delete objects using that backend authority.
What should be done if an immediate upgrade is not possible?
Avoid allowing accepted credentials with the same username to resolve to different proxy backends, and ensure overlapping sessions in that condition cannot occur. Upgrade to rclone 1.75.1 when possible.