FTP Authentication Vulnerability in Rclone Affects File Management Capabilities
CVE-2026-88017

7.3HIGH

Key Information:

Vendor

Rclone

Status
Rclone
Vendor
CVE Published:
10 September 2026

What is CVE-2026-88017?

A vulnerability in Rclone's FTP auth-proxy driver allows improper binding of user credentials, leading to potential unauthorized access. Specifically, from versions 1.64.0 to 1.75.1, the system stores obscured passwords in a userPass map, which can be overwritten if multiple sessions use the same username but connect to different backends. This creates a scenario where a new login can compromise the permissions of an active session, allowing a user to perform operations under another credential's authority. The issue is resolved in version 1.75.1.

Affected Version(s)

rclone >= 1.64.0, < 1.75.1

References

https://github.com/rclone/rclone/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/rclone/rclone/commit/c6af0b57c2b4af848...
x_refsource_MISC
https://github.com/rclone/rclone/releases/tag/v1.75.1
x_refsource_MISC

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.