CVE-2026-88044

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88044
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88044.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-88044
Aliases
Downstream
Published
2026-09-10T16:08:14Z
Modified
2026-09-12T03:47:21Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
rclone: RC per-server auth-proxy bypass
Details

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88044.json"
}
References

Affected packages

Git / github.com/rclone/rclone

Affected ranges

Type
GIT
Repo
https://github.com/rclone/rclone
Events
Introduced
9d464e8e9a56a988bbb5f701006173c9bbefeb6a
Fixed
739403963abf6f58003c2becd5f7c4ad0d644153
Fixed
687d264b689b8c49a67e2e52a8a5e0caa01c04ce
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.70.0"
        },
        {
            "fixed": "1.75.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.70.0
v1.71.0
v1.72.0
v1.73.0
v1.74.0
v1.75.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88044.json"