DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-88044: CVE-2026-88044: Authentication Bypass in rclone Dynamic Server Execution via Remote Control API

#security #cve #cybersecurity

CVE-2026-88044: Authentication Bypass in rclone Dynamic Server Execution via Remote Control API

Vulnerability ID: CVE-2026-88044
CVSS Score: 9.1
Published: 2026-09-10

An authentication bypass vulnerability exists in rclone when dynamically starting FTP, S3, or SFTP servers via the Remote Control (RC) 'serve/start' API. The server constructors incorrectly check the global process configuration rather than request-scoped options, resulting in a silent bypass of the authentication proxy and enabling unauthenticated access.

TL;DR

rclone's dynamic server creation endpoint fails to enforce requested authentication proxies, falling back to unauthenticated anonymous access or exposing root filesystems.

Technical Details

  • CWE ID: CWE-863
  • Attack Vector: Network (AV:N)
  • CVSS v3.1: 9.1 (Critical)
  • EPSS Score: N/A
  • Impact: Authentication Bypass / Unauthorized Read & Write
  • Exploit Status: None (No public PoC)
  • CISA KEV Status: Not Listed

Affected Systems

  • rclone
  • rclone: >= 1.70.0, < 1.75.1 (Fixed in: 1.75.1)

Code Analysis

Commit: 7394039

Refactor serve auth proxy handling to prevent global vs request scope confusion

Mitigation Strategies

  • Upgrade rclone to version 1.75.1 or later.
  • Disable the Remote Control (RC) HTTP API if not required.
  • Bind the Remote Control API strictly to loopback interfaces and require authentication.

Remediation Steps:

  1. Identify running rclone processes and determine if the Remote Control API is enabled (--rc).
  2. Upgrade the rclone binary to version 1.75.1 using the system package manager or official binaries.
  3. If dynamic servers are necessary, verify that client requests contain the proper authentication configurations.
  4. Implement network-level firewall rules to block unauthorized external access to dynamic server ports.

References

Read the full report for CVE-2026-88044 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)