CVE-2026-88018: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then verifies the request’s SigV4 signature against that same empty secret, while Server.auth passes the access key identifier as both the user and authentication value to the proxy without an independent per-identity secret. An unauthenticated network attacker can therefore choose an arbitrary access key, sign with an empty secret, and reach whatever backend the auth-proxy script resolves for that identity. This issue is fixed in version 1.75.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rclone serve s3to a version that resolves this vulnerability.Fixed in 1.75.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running rclone serve s3 prior to 1.75.1 are exposed when they use --auth-proxy without also configuring --auth-key. The issue is reachable by an unauthenticated network attacker.
What does an attacker need to exploit this?
An attacker can choose an arbitrary access key ID and create an S3 SigV4 request signed with an empty secret. No valid credentials or user interaction are required.
What access can exploitation provide?
The attacker can reach whichever backend the auth-proxy script resolves for the chosen access-key identity. The resulting impact includes high confidentiality, integrity, and availability impact.
What should be done if the affected configuration is in use?
Upgrade rclone to version 1.75.1. Until upgrading, do not run --auth-proxy without --auth-key.