CVE-2026-88018PoC(rclone / rclone)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch rclone rclone systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then verifies the request’s SigV4 signature against that same empty secret, while Server.auth passes the access key identifier as both the user and authentication value to the proxy without an independent per-identity secret. An unauthenticated network attacker can therefore choose an arbitrary access key, sign with an empty secret, and reach whatever backend the auth-proxy script resolves for that identity. This issue is fixed in version 1.75.1.

rclone CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/rclone/rclone/commit/90595f34f27f569be6b27c57fe5ab65057d323bd

Vendor / third-party advisories

Other references

https://github.com/rclone/rclone/releases/tag/v1.75.1

Weakness type (CWE)

CWE-287CWE-306

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

rclone

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-09-11); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

rclone

Products

rclone

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

PoC

150.0%

Disclosure

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-11	1	PoC1
2026-09-12	1	Disclosure1

Full discourse2 posts

Upwind Security MDR@UpwindMDR46d
Disclosure
🚨Critical - rclone serve s3 AWS SigV4 Auth Bypass via Empty Secret (CVE-2026-88018) In rclone's S3 server, starting `rclone serve s3` with `--auth-proxy` but without `--auth-key` lets clients pick any access key ID and get it registered with an empty secret, bypassing AWS SigV4 verification. Remote unauthenticated attackers can sign with an empty secret and access whatever backend the auth-proxy maps for that identity. 👉Affected: http://github.com/rclone/rclone < 1.75.1 | Upgrade to 1.75.1
Post summary
The tweet discloses a critical authentication bypass in rclone’s S3 server (CVE-2026-88018), explaining that using `--auth-proxy` without `--auth-key` registers an empty secret and enables remote unauthenticated access, and recommends upgrading to version 1.75.1.
00000118
304 followersView on X
Hephaestvs@Vulcanux_46d
PoC
csirt_it: ‼️ Disponibili #PoC per lo sfruttamento di 5 vulnerabilità presenti in #Rclone Rischio: 🔴 Tipologia: 🔸 Authentication Bypass 🔸 Security Feature Bypass 🔸 Denial of Service 🔗 https://www.acn.gov.it/portale/w/rclone-poc-pubblici-per-lo-sfruttamento-delle-cve-2026-88018-cve-2026-88044-cve-2026-88045-cve-2026-88016-e-cve-2026-88017 ⚠️ Importante mantenere aggiornati i s… https://t.co/hTiluqXiEA
Post summary
The tweet announces that PoC code for five Rclone CVEs is publicly available, encouraging users to update.
0000047
636 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	rclone	rclone	-	-	-

Explore more

Back to dashboard rclone CVEs rclone vulnerabilities