CVE-2026-88018
rclone versions before 1.75.1 have a critical authentication flaw in `rclone serve s3` when `--auth-proxy` is used without `--auth-key`. An unauthenticated network attacker can select an access key ID, sign requests with an empty secret, and reach the backend selected for that identity; the issue is fixed in rclone 1.75.1.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running rclone versions before 1.75.1 with `rclone serve s3` configured using `--auth-proxy` but without `--auth-key` are affected. No affected products were listed in the supplied CPE data.
Real-world impact
An attacker may access backend services associated with a chosen identity without prior authentication.
Why this severity
The vulnerability is rated critical because it can be exploited remotely without authentication, has low complexity, and may expose, modify, or disrupt data.
What to do about it
- 01Upgrade rclone to version 1.75.1.
The NVD description states that the issue is fixed in rclone version 1.75.1.
Timeline
- Sep 10, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.