EUVD-2026-75577
GHSA-c476-6w5q-jw77
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
AC:H reflects the timing race requiring concurrent same-username sessions on the same server; PR:L for required FTP authentication; A:N as no availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the credential or VFS to the authenticated session. If two accepted credentials use the same username but resolve to different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS operations on the first session are reauthorized with the later password. The first session can then read, create, overwrite, rename, or delete objects using the second credential’s backend authority. Exploitation requires the later same-username login to occur while the first session remains open. This issue is fixed in version 1.75.1.
AnalysisAI
Cross-session credential isolation failure in rclone's FTP auth-proxy driver (versions 1.64.0-1.75.0) allows an authenticated network attacker to hijack a victim user's cloud storage backend by exploiting a server-wide, username-keyed credential map. When an attacker holds an open FTP session using a shared username and a victim subsequently authenticates with the same username, the victim's credential silently overwrites the server-wide map entry - causing the attacker's subsequent VFS operations to execute against the victim's backend, enabling reads, writes, renames, and deletions of the victim's cloud objects. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All of the following must hold simultaneously: (1) rclone is deployed in `rclone serve ftp` mode with an external auth-proxy configured (the `--auth-proxy` flag or equivalent), running a vulnerable version 1.64.0-1.75.0 - non-FTP rclone modes and all versions outside this range are entirely unaffected; (2) at least two clients share the same FTP username but hold different credentials that the auth-proxy resolves to distinct backends - this structural username collision is the core prerequisite, absent in deployments with per-credential unique usernames; (3) the attacker's authenticated session must remain open when the victim logs in with the same username, and the attacker must subsequently issue a VFS-requiring command before their own session expires or the map is overwritten again. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) partially captures the risk, but AC:L likely overstates exploitation ease. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade rclone to version 1.75.1 (vendor-released patch), available at https://github.com/rclone/rclone/releases/tag/v1.75.1 and implemented in commit c6af0b57c2b4af848bc968c2b407354476184b99. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running rclone versions 1.64.0 through 1.75.0, particularly those using the FTP auth-proxy driver for cloud storage access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in rclone's S3 server mode (rclone serve s3) allows any unauthenticated network attacker to impers
PowerShell smart-quote filename injection in rclone's SFTP backend allows an attacker who controls remote filenames to e
An issue was discovered in Rclone before 1.53.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Symlink escape in rclone's local backend (prior to v1.75.1) allows an attacker who controls sync source contents to appl
FTP CRLF injection in rclone before 1.75.0 allows an attacker who can place crafted filenames in a source namespace to i
Cleartext disclosure of AWS STS session tokens affects rclone before 1.74.4 when its S3 backend follows a redirect that
Authentication/authorization bypass in rclone's dynamic serve interface (versions 1.70.0 through 1.75.0) lets remote att
Path traversal in the `rclone serve restic --private-repos` REST server (versions prior to 1.74.4) allows an authenticat
Arbitrary file write via symlink traversal in Rclone prior to 1.74.4 lets an attacker-controlled remote escape the local
Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or hos
In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to t
Denial-of-service vulnerabilities in rclone's archive backend SquashFS parser allow an attacker with write access to rcl
Same weakness CWE-488 – Exposure of Data Element to Wrong Session
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today