CVE-2026-88044: rclone per-server auth-proxy bypass in FTP and S3

Executive brief

rclone is a cloud storage synchronization tool that supports running FTP and S3 protocol servers via remote control (RC) API. When an operator configures an authentication proxy for per-server security, the FTP and S3 server implementations incorrectly ignore this setting and fall back to insecure defaults. For FTP, this allows any client to log in as "anonymous" with an arbitrary password and read, write, or delete files. For S3, clients with valid authentication keys can access the wrong backend filesystem, bypassing the intended per-key routing policy.

Technical details

The vulnerability is a configuration scope mismatch in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go. Both RC adapters parse per-server proxy options (proxyOpt.AuthProxy) from the serve/start request and pass them to their server constructors, but the constructors incorrectly branch on the process-global proxy.Opt.AuthProxy instead of the supplied proxyOpt.AuthProxy. When the global option is empty—the normal case when proxy settings are only configured per RC request—the supplied authentication proxy is silently ignored. For FTP, the code falls back to fixed-backend mode with hardcoded "anonymous" credentials and an empty password that accepts any authentication attempt, exposing file read, write, and delete operations. For S3, the code similarly falls back to the fixed filesystem, allowing holders of any valid auth_key to reach the RC-configured fs instead of the filesystem routed by the auth proxy. The root cause is checking the wrong variable; the fix requires changing the mode-selection logic to test the request-local proxyOpt object. Exploitation requires network access to the FTP or S3 listener and does not require CLI-level changes or global configuration manipulation.

Affected products

• rclone rclone >=1.70.0, <1.75.1

Timeline

• 2026-09-04: disclosed: GitHub Advisory GHSA-p569-5gjg-9cmj published
• 2026-09-10: advisory: Public advisory with full technical analysis and proof of concept
• 2026-09-11: patched: Fix released in rclone v1.75.1

References

• https://api.github.com/users/cyberlanc3r
• https://github.com/cyberlanc3r
• https://api.github.com/users/cyberlanc3r/gists%7B/gist_id%7D
• https://api.github.com/users/cyberlanc3r/repos
• https://avatars.githubusercontent.com/u/216992819?v=4
• https://api.github.com/users/cyberlanc3r/events%7B/privacy%7D