Log in / Sign up

Vulnerability details

CVE-2026-88018

rclone rclone

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

CVSS 3.1
9.8Critical

Official description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then verifies the request’s SigV4 signature against that same empty secret, while Server.auth passes the access key identifier as both the user and authentication value to the proxy without an independent per-identity secret. An unauthenticated network attacker can therefore choose an arbitrary access key, sign with an empty secret, and reach whatever backend the auth-proxy script resolves for that identity. This issue is fixed in version 1.75.1.

CVSS scores

ScoreVersionSourceVector
9.8Critical 3.1 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
rclone rclone < 1.75.1 CVEProject cvelistV5 (CNA)

References and advisories

3
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-09-10
Last updated
2026-09-10
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.51%
Probability of exploitation in 30 days
43.8%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
Proof of concept
Technical impact
Total

Weaknesses (CWE)

  • CWE-287
    Improper Authentication
  • CWE-306
    Missing Authentication for Critical Function