Rclone 1.70.x < 1.75.1 RC Per-Server Auth-Proxy Bypass (CVE-2026-88044)

The version of Rclone installed on the remote host is 1.70.x prior to 1.75.1. It is, therefore, affected by an authentication bypass vulnerability: - The serve/start remote control method accepts protocol options in a per-server proxyOpt object, but the FTP and S3 server constructors decide wheth...

CVE-2026-88044

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...