DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-88017: CVE-2026-88017: Cross-Session Authentication-Proxy Backend Confusion in rclone FTP Server

#security #cve #cybersecurity

CVE-2026-88017: Cross-Session Authentication-Proxy Backend Confusion in rclone FTP Server

Vulnerability ID: CVE-2026-88017
CVSS Score: 7.3
Published: 2026-09-10

The FTP server implementation of rclone is vulnerable to a cross-session identity and credential confusion flaw when configured with an authentication proxy. Under specific multi-tenant configurations where multiple distinct sessions authenticate with the same username, a global map caches credentials globally instead of isolating them inside the session context. This allows a concurrent attacker to hijack the active session backend of a victim using the same username.

TL;DR

A global credential map in rclone's FTP auth-proxy driver allows an attacker sharing a generic username to hijack a victim's concurrent FTP session storage backend.

Technical Details

  • CWE ID: CWE-488 (Exposure of Data Element to Wrong Session)
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.3 (High)
  • Exploit Status: poc
  • KEV Status: Not Listed
  • Impact: Complete Cross-Session Information Disclosure and File Integrity Compromise

Affected Systems

  • rclone FTP server configurations utilizing the --auth-proxy option

Mitigation Strategies

  • Upgrade rclone to version 1.75.1 or newer to ensure session isolation.
  • Configure the authentication proxy script to guarantee unique usernames for all connecting clients.
  • Deactivate the --auth-proxy flag on exposed FTP server instances if unique usernames cannot be enforced.

Remediation Steps:

  1. Verify the running version of rclone using the command: rclone version.
  2. Locate and download the appropriate patch release of rclone (v1.75.1+) from the official releases archive.
  3. Replace the old rclone binary on the target system and restart the serve ftp daemon processes.
  4. Verify that the driver-global cache has been eliminated by reviewing system configurations and checking the active session state logic.

References

Read the full report for CVE-2026-88017 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)