External risk intelligence

Rclone FTP and S3 Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-88044

rclone is frequently used to host services like FTP or S3-compatible interfaces. When these servers are configured to expose file systems over the network, they often function as public-facing or internal-facing gateways, making the authentication bypass reachable in common deployment scenarios.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects rclone, a utility for managing cloud storage. Specifically, it impacts network-facing servers that handle authentication for file transfers. The issue could allow unauthorized access to data when specific proxy configurations are in place. The main concern is confirming relevance and exposure within your environment.

Unhandled proxy settings could bypass access controls.
Affects network services handling cloud file transfers.
Confirm if rclone servers are exposed externally.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending specially crafted requests to a vulnerable rclone server that is configured to use per-server proxy options. The vulnerability lies in how the server handles proxy authentication settings, allowing an attacker to bypass intended authentication for FTP and S3 services. This bypass could expose sensitive files or data to unauthorized access.

Network access required.
Unauthenticated proxy settings.
Unauthorized file access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass authentication when rclone is used to serve files over FTP or S3. If configured to use per-server proxy authentication, a flaw in how proxy options are checked could lead to unauthorized access to data. This could occur when the global proxy authentication setting is empty.

File system data could be exposed.
Bypassed authentication on network-served files.
Unauthorized access to stored files.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this vulnerability in rclone. The first practical step is to identify all instances of rclone, confirm if they are exposed externally or to sensitive internal networks, and determine the business criticality of each instance before planning remediation.

Application and infrastructure teams own this.
Verify exposed rclone instances immediately.
Plan remediation based on business risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is rclone?

rclone is a command-line tool designed to manage files across various cloud storage providers. It includes features to serve these files over standard network protocols like FTP and S3, effectively acting as a bridge or gateway between local file systems and cloud storage services.

What does CWE-863 mean for CVE-2026-88044?

CWE-863 refers to an Incorrect Authorization weakness. In this specific CVE, the rclone software fails to properly verify user credentials. Because the system checks the wrong configuration setting, it mistakenly allows unauthorized access to data that should be protected.

How is this vulnerability triggered?

The issue occurs when an rclone server is configured to use per-server proxy settings while the global authentication proxy option is empty. It is not triggered when using dedicated command-line servers that correctly define global options, nor does it impact environments where these specific proxy configurations are not in use.

Is my rclone instance at risk?

Risk depends on how you deploy rclone. According to Halo Surface Signal, this software is frequently used to host network-facing FTP or S3 gateways. If your instance is exposed to the internet or reachable from untrusted internal networks, the authentication bypass could be reachable by unauthorized users.

How do I respond to this vulnerability?

First, locate all active instances of rclone within your infrastructure. Once identified, evaluate whether they are exposed to the network and if they utilize per-server proxy configurations. Prioritize updating these systems to version 1.75.1, which corrects how the software handles authentication settings.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.