CVE-2026-88044: rclone: RC per-server auth-proxy bypass
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rcloneto a version that resolves this vulnerability.Fixed in 1.75.1
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use the RC serve/start interface with a per-server proxyOpt.AuthProxy setting on rclone versions from 1.70.0 until 1.75.1. Dedicated command-line FTP and S3 servers that configure the process-global authentication-proxy option are not affected.
Can this be exploited without credentials?
For affected FTP servers, the ignored request-local authentication proxy causes fallback to the fixed filesystem and accepts the username anonymous with any password. For affected S3 servers using AuthKey, requests are served from the fixed RC filesystem rather than the backend selected by the proxy.
How can I determine whether my configuration is vulnerable?
Check whether FTP or S3 was launched through RC serve/start with per-server proxyOpt.AuthProxy configured while the process-global proxy.Opt.AuthProxy is empty. That combination causes the per-server authentication proxy to be ignored.
What should I do if I cannot update immediately?
Avoid using the affected RC serve/start per-server AuthProxy configuration for FTP or S3. Dedicated command-line servers that configure the global authentication-proxy option are described as unaffected.