CVE-2026-88018

Publication date 10 September 2026

Last updated 24 September 2026

Ubuntu priority

Cvss 3 Severity Score

Description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then verifies the request’s SigV4 signature against that same empty secret, while Server.auth passes the access key identifier as both the user and authentication value to the proxy without an independent per-identity secret. An unauthenticated network attacker can therefore choose an arbitrary access key, sign with an empty secret, and reach whatever backend the auth-proxy script resolves for that identity. This issue is fixed in version 1.75.1.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
rclone	26.04 LTS resolute	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected

Notes

whershberger

introduced in upstream commit 9de485f949b818e2b6dd0384 >= 1.68.0 `rclone serve s3` is disabled at compile-time in Debian with `d/p/0012-Disable-S3-server.patch` since 1.65.0+dfsg-2

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
rclone	Upstream: 90595f3

Severity score breakdown

CVSS version: CVSS v3.0

Base score 9.8 · Critical

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High

Scores

Parameter	Value
Base score	9.8 · Critical
Exploitability score	-
Impact score	-

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H