CVE-2026-88044

rclone versions 1.70.0 through 1.75.1 are affected by an authentication proxy bypass in the serve/start RC interface. The FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead of the per-server request-loc...