Rclone: Critical and High Severity Vulnerabilities Disclosed in Single Batch
Key findings • Nine Rclone vulnerabilities disclosed on September 10, 2026, ranging from Low to Critical severity. • Critical vulnerabilities (CVE-2026-88018, CVE-2026-88044) impact serve S3,…
Key findings
- Nine Rclone vulnerabilities disclosed on September 10, 2026, ranging from Low to Critical severity.
- Critical vulnerabilities (CVE-2026-88018, CVE-2026-88044) impact serve S3, RC, FTP, and authentication proxy handling.
- High severity flaws affect serve S3 multipart uploads, FTP auth-proxy, and local backend symbolic link handling.
- Vulnerabilities addressed in Rclone version 1.75.1; users urged to update immediately.
- Issues span across S3, FTP, ZIP backends, and symbolic link processing.
On September 10, 2026, a batch of nine vulnerabilities was disclosed for Rclone, a popular command-line utility for managing cloud storage. The vulnerabilities, disclosed within a one-hour window, range in severity from Low (CVSSv3 3.7) to Critical (CVSSv3 9.8), impacting various Rclone features including its serve S3, FTP, and ZIP backends, as well as its handling of symbolic links and directory metadata. The most severe issues, CVE-2026-88018 and CVE-2026-88044, are critical severity flaws that could allow for unauthorized access or control over Rclone instances.
Several vulnerabilities stem from insecure handling of authentication and proxy settings within Rclone's serve interfaces. CVE-2026-88018, a critical severity vulnerability, arises when the Rclone serve S3 backend is configured with an authentication proxy but lacks an authentication key. This misconfiguration allows an attacker to register a chosen access key ID with an empty secret, which is then improperly verified by the gofakes3 implementation. Another critical flaw, CVE-2026-88044, affects the RC interface and the FTP and S3 constructors. It allows per-server proxy authentication options to be accepted, with incorrect validation of proxy settings in the FTP and S3 backends.
High severity vulnerabilities also target the serve S3 and FTP functionalities. CVE-2026-88045, for instance, involves the serve S3 streamed multipart path, where an attacker-controlled contentLength is passed to multipart.NewRW().Reserve before the request body is read, potentially leading to issues during multipart upload processing. Similarly, CVE-2026-88017, affecting the FTP auth-proxy driver, stores obscured passwords per username in a server-wide map instead of binding them to specific server instances or VFS structures, creating a potential for credential misuse.
The batch also includes vulnerabilities related to file handling and metadata. CVE-2026-88016, a high severity issue, occurs when the local backend runs with the --links flag. A malicious .rclonelink object can be used to plant a symbolic link, through which directory metadata is later applied, potentially leading to unintended file system modifications. Medium severity flaws include CVE-2026-88046, which involves parent-directory segments in source Object.Remote() values not being properly rejected before being passed to destination backends. CVE-2026-88015 exposes symlink targets as .rclonelink objects, and unchecked Range values can be passed through Object.Open and openTranslation, potentially leading to unintended file access. CVE-2026-88014, affecting the ZIP archive backend, accepts untrusted file names from a central directory, exposing cleaned entry names with potential security implications. Finally, CVE-2026-88013, a low severity vulnerability, concerns the HTTP backend's handling of redirects without a fallback, where configured headers are attached to requests.
All disclosed vulnerabilities were addressed in Rclone version 1.75.1. Users are strongly advised to update to this version to mitigate the risks associated with these security flaws. The wide range of affected components and the presence of critical severity vulnerabilities underscore the importance of timely updates for Rclone users.
The vulnerabilities were patched in Rclone version 1.75.1. The critical CVEs are CVE-2026-88018 and CVE-2026-88044. High severity CVEs include CVE-2026-88045, CVE-2026-88017, and CVE-2026-88016. Medium severity CVEs are CVE-2026-88046, CVE-2026-88015, and CVE-2026-88014. Low severity CVE is CVE-2026-88013. The disclosure occurred on September 10, 2026.