CVE-2026-88018: CVE-2026-88018: Authentication Bypass in rclone S3 Server Component via Empty HMAC Secret

#security #cve #cybersecurity

CVE-2026-88018: Authentication Bypass in rclone S3 Server Component via Empty HMAC Secret

Vulnerability ID: CVE-2026-88018
CVSS Score: 9.8
Published: 2026-09-10

Prior to version 1.75.1, rclone's S3 server component ('rclone serve s3') contains an authentication bypass vulnerability when configured with '--auth-proxy' but without '--auth-key'. The application validates AWS Signature Version 4 (SigV4) against an empty secret key string, enabling unauthenticated remote attackers to access storage backends.

TL;DR

Unauthenticated remote attackers can bypass S3 signature verification in 'rclone serve s3' by using an empty cryptographic signature when '--auth-key' is omitted, obtaining unauthorized read/write access to mapped storage backends.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-287 / CWE-306
Attack Vector: Network
CVSS v3.1 Score: 9.8
Exploit Status: poc
CISA KEV Status: No
Ransomware Use: No

Affected Systems

rclone S3 Server Component (rclone serve s3)
rclone: < 1.75.1 (Fixed in: 1.75.1)

Mitigation Strategies

Upgrade the rclone software installation to version 1.75.1 or later.
Modify custom external proxy scripts to return the S3 secret under the '_secret_access_key' field.
Enforce the '--auth-key' command-line flag with a secure, random string if immediate upgrades are not feasible.
Configure network-level firewalls to restrict S3 endpoint access to trusted hosts.

Remediation Steps:

Download and install rclone version 1.75.1 from the official repository.
Update your auth-proxy scripts to ensure that they accept S3 requests and output JSON containing '_secret_access_key'.
Deploy network access controls to isolate the 'rclone serve s3' service from public network interfaces.

References

Read the full report for CVE-2026-88018 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community