← Vulnerability feed

Vulnerability record · CVE-2026-88018 · published 10 September 2026

CVE-2026-88018: Rclone improper authentication vulnerability

Rclone · Rclone

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then verifies the request’s SigV4 signature against that same empty secret, while Server.auth passes the access key identifier as both the user and authentication value to the proxy without an independent per-identity secret. An unauthenticated network attacker can therefore choose an arbitrary access key, sign with an empty secret, and reach whatever backend the auth-proxy script resolves for that identity. This issue is fixed in version 1.75.1.

9.8 CVSS 3.1 Critical EPSS 0.75% · top 46.8% CWE-287 · Improper authenticationCWE-306 · Missing authentication for critical function
9.8CVSS 3.1 base score
0.75%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
14 Sep 2026Last modified by NVD

Description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then verifies the request’s SigV4 signature against that same empty secret, while Server.auth passes the access key identifier as both the user and authentication value to the proxy without an independent per-identity secret. An unauthenticated network attacker can therefore choose an arbitrary access key, sign with an empty secret, and reach whatever backend the auth-proxy script resolves for that identity. This issue is fixed in version 1.75.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/rclone/rclone/commit/90595f34f27f569be6b27c57fe5ab65057d323bd Patch
https://github.com/rclone/rclone/releases/tag/v1.75.1 Release Notes
https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c Vendor Advisory
https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c Vendor Advisory

Track CVE-2026-88018 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-49980Rclone missing authentication for critical function vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --…EPSS 0.78%9.2CVE-2026-41176Rclone missing authentication for critical function vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is expose…EPSS 3.2%9.2CVE-2026-41179Rclone os command injection vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to…EPSS 5.3%8.8CVE-2026-59733Rclone path traversal vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --…EPSS 0.55%8.8CVE-2026-54572Rclone link following vulnerabilityRclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclon…EPSS 0.40%7.5CVE-2020-28924Rclone vulnerabilityAn issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak pas…EPSS 1.4%7.5CVE-2018-12907Rclone information exposure vulnerabilityIn Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of an…EPSS 1.3%7.3CVE-2026-88017Rclone vulnerabilityrclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-…EPSS 0.43%

Source: NIST National Vulnerability Database (record CVE-2026-88018), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.