BIT-RCLONE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

PT-2026-99020

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

SUSE CVE-2026-88045

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

CVE-2026-88018

A flaw was found in rclone. When the rclone serve s3 command is configured with --auth-proxy but without --auth-key, an unauthenticated network attacker can bypass the SigV4 signature verification process. This allows the attacker to use an arbitrary access key and sign requests with an empty...

PT-2026-95842

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

GO-2026-6462 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone

rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone...

BIT-RCLONE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

Linux Distros Unpatched Vulnerability : CVE-2026-88018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with...

Linux Distros Unpatched Vulnerability : CVE-2026-88045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the authentication process when the --auth-proxy option is enabled without also setting --auth-key. An attacker can gain unauthorized access by supplying any access key ID and signing...

GHSA-XWWR-4H3P-R22C rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

Summary rclone serve s3's handler chain, when --auth-proxy is configured, is outermost first: authPairMiddleware - proxyAuthMiddleware - gofakes3's own SigV4-verifying handler. authPairMiddleware parses the accessKeyID straight out of the incoming request's own Authorization header entirely...

CVE-2026-88045 rclone: S3 multipart declared-length memory exhaustion

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

CVE-2026-88018

rclone (a command-line tool for syncing files to cloud storage) contains a SigV4 signature bypass in its serve s3 mode. When configured with --auth-proxy but without --auth-key, the authPairMiddleware registers any client-chosen accessKeyID with an empty secret. The embedded gofakes3 component th...

CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-88018

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes...

CVE-2026-88045: Memory Allocation with Excessive Size Value

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

PT-2026-89489

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.1 Description When rclone serve s3 is configured with the --auth-proxy flag but without the --auth-key flag, the authPairMiddleware function registers any client-provided accessKeyID with an empty ws.s3Secret. The...

PT-2026-89704

Summary rclone serve s3's handler chain, when --auth-proxy is configured, is outermost first: authPairMiddleware - proxyAuthMiddleware - gofakes3's own SigV4-verifying handler. authPairMiddleware parses the accessKeyID straight out of the incoming request's own Authorization header entirely...