CVE-2026-88044 rclone: RC per-server auth-proxy bypass
Attackers can bypass authentication in rclone's FTP and S3 servers by exploiting a configuration check error, gaining unauthorized access to data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-88044?
CVE-2026-88044 is a critical authentication bypass vulnerability in rclone, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.
Weakness: CWE-863
Which versions are affected by CVE-2026-88044?
4 open source packages ship an affected version, including github.com/rclone/rclone and rclone.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rclone/rclone Go | From 1.70.0 | 1.75.1 |
github.com/rclone/rclone Go | From 1.70.0 | 1.75.1 |
github.com/rclone/rclone Go | From 1.70.0 | 1.75.1 |
rclone Bitnami | From 1.70.0 | 1.75.1 |
How do I fix CVE-2026-88044?
Upgrade github.com/rclone/rclone to 1.75.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-88044 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88044 exists.
Sources
Also known as BIT-rclone-2026-88044, DEBIAN-CVE-2026-88044, GHSA-p569-5gjg-9cmj, GO-2026-6460, MINI-79jr-2666-9362, MINI-9ww7-6g85-mfpg and 4 more.