rclone CVE-2026-88044

Exploitation requires the target to run an rclone FTP or S3 server that was created dynamically through the serve/start RC interface with a per-server proxyOpt.AuthProxy configured, while the process-global proxy.Opt.AuthProxy is empty (the default for RC-launched servers). Under that condition no authentication is needed: for FTP the attacker logs in as username 'anonymous' with any password against the fixed VFS; for S3 an AuthKey request is served the fixed RC fs rather than the proxy-selected backend. Limiting factors: servers started via the dedicated command-line subcommands (which set the global AuthProxy) are NOT vulnerable, so only the RC/serve-start deployment pattern with an auth proxy is affected, and only rclone 1.70.0 through 1.75.0.

The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting unauthenticated network access with high confidentiality and integrity impact but no availability impact - consistent with anonymous read/write to a fixed filesystem. However, real-world risk is gated by a specific and non-default operational precondition: the affected FTP/S3 server must be launched through the serve/start RC API with a per-server auth proxy configured while the process-global AuthProxy is empty. Dedicated command-line servers (rclone serve ftp/s3 --auth-proxy ...) that set the global option are explicitly NOT affected, which sharply narrows the exposed population. No EPSS score, KEV listing, or public POC is provided, so there is no evidence of active or automatable exploitation; the score is high because of impact, not because of demonstrated widespread abuse. Operators running rclone's RC-driven multi-tenant FTP/S3 servers with auth proxies should treat this as urgent, since the failure mode silently downgrades tenant isolation to anonymous or fixed-backend access.

An operator uses rclone's RC serve/start API to stand up a multi-tenant FTP server, expecting each user's credentials to be resolved by an auth proxy to their own isolated backend. Because the global AuthProxy is empty, the proxy is ignored and a remote attacker simply connects to the FTP port and logs in as 'anonymous' with any password, gaining access to the fixed backend filesystem; against the S3 variant with AuthKey they receive the fixed RC fs instead of the intended proxy-selected backend. No public exploit code is identified, but the attack requires only a standard FTP/S3 client.