CVE-2026-88044
A flaw in rclone’s serve/start RC interface caused the program to ignore per-server authentication proxy settings for FTP and S3. As a result, FTP connections defaulted to anonymous access and S3 connections served a fixed filesystem instead of the intended backend. The bug was fixed in rclone version 1.75.1.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
rclone versions 1.70.0 through 1.75.1, used by users who run the serve/start RC interface with per-server proxy authentication settings.
Real-world impact
An attacker could exploit the flaw to bypass authentication, gaining anonymous read or write access to FTP servers or to the fixed rclone filesystem via S3, potentially exposing or altering sensitive data.
Why this severity
The CVSS score of 9.1 reflects a network-based attack that requires no user interaction, no privileges, and provides full confidentiality and integrity compromise. The low attack complexity and lack of required privileges make it highly exploitable.
What to do about it
- 01Upgrade rclone to version 1.75.1 or later.
- 02Restart any rclone services to apply the new version.
NVD-referenced vendor advisory
Timeline
- Sep 10, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.