Critical 9.1Published Sep 10, 2026

CVE-2026-88044rclone: RC per-server auth-proxy bypass

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects rclone. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for rclone

Exploited in the last 30 days

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.

CVSS: 9.1 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-863
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Awaiting Analysis
Record last updated: Sep 10, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

rclone rclone rclone:rclone (from the name)	from 1.70.0, < 1.75.1	CNA record

References

https://github.com/rclone/rclone/security/advisories/GHSA-p569-5gjg-9cmjx-refsource-confirm
https://github.com/rclone/rclone/commit/739403963abf6f58003c2becd5f7c4ad0d644153x-refsource-misc
https://github.com/rclone/rclone/releases/tag/v1.75.1x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.