CVE-2026-88017
Received Received - Intake

FTP Auth-Proxy Credential Overwrite in rclone

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the credential or VFS to the authenticated session. If two accepted credentials use the same username but resolve to different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS operations on the first session are reauthorized with the later password. The first session can then read, create, overwrite, rename, or delete objects using the second credential’s backend authority. Exploitation requires the later same-username login to occur while the first session remains open. This issue is fixed in version 1.75.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88017
EUVD
EUVD-2026-75577

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rclone rclone to 1.75.1 (exc)
rclone rclone 1.75.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-488 The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects rclone versions 1.64.0 to 1.75.0. It involves the FTP auth-proxy driver storing obscured passwords in a server-wide map keyed only by username. If two sessions authenticate with the same username but different credentials, the later login overwrites the stored password. This causes earlier sessions to use the overwritten password, executing commands against the wrong backend.

Detection Guidance

To detect this vulnerability, check if your rclone FTP server is running versions 1.64.0 to 1.75.0 and uses the --auth-proxy feature. Review logs for multiple sessions using the same username but different credentials. No specific commands are provided in the context.

Impact Analysis

A low-privileged user with valid credentials could gain unauthorized access to another user's backend data. This includes reading, writing, renaming, or deleting files. Exploitation requires the attacker's session to remain open while the victim logs in with the same username.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or deletion, violating confidentiality and integrity requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with access controls, and potential legal consequences.

Mitigation Strategies

Upgrade rclone to version 1.75.1 or later to fix the issue. Disable the --auth-proxy feature if not required. Ensure credentials are bound to sessions rather than usernames to prevent cross-session authorization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88017. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart