rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the credential or VFS to the authenticated session. If two accepted credentials use the same username but resolve to different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS operations on the first session are reauthorized with the later password. The first session can then read, create, overwrite, rename, or delete objects using the second credential’s backend authority. Exploitation requires the later same-username login to occur while the first session remains open. This issue is fixed in version 1.75.1.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3129 advisory.

    On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root     when the final path component of the a path is a symbolic link and the path ends in /. For example,     'root.Open(symlink/)' will open symlink even when symlink is a symbolic link pointing outside of the     root. (CVE-2026-39822)

    Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a     disclosure of pre-shared key identities in the unencrypted client hello. (CVE-2026-42505)

    VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a     crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a     denial of service via memory exhaustion. (CVE-2026-46603)

    The source-address critical option in the Permissions returned by an authentication callback was only     enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for     CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback,     NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's     remote address, so a source-address restriction set by those callbacks was silently ignored. The check is     now applied to the Permissions returned by any authentication callback. (CVE-2026-56854)

    Previously, after a channel has been established, a malicious peer could send crafted messages that would     deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled     explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of     buffering and blocking. (CVE-2026-56855)

    Rclone is a command-line program to sync files and directories to and from different cloud storage     providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected     destination prefix when extracting a crafted archive containing parent path components such as ../,     allowing creation or overwrite of sibling objects in the same bucket or path scope. This issue is fixed in     version 1.74.4. (CVE-2026-59732)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the     configurable filename encoder to prevent remote filename data from becoming operating-system path syntax,     so a local destination using Slash, None, Raw, or on Windows an encoding that preserves backslash can     decode a standard-encoded fullwidth dot-dot component or native backslash form into an actual parent-     directory component before filepath.Join resolves it outside the configured local root, allowing an     attacker-controlled source object to create or overwrite files outside the selected destination directory     as the rclone process. This issue is fixed in v1.75.0. (CVE-2026-71313)

    Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious     peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an     atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every     packet other than the open confirmation/failure, without blocking and without tearing down the connection.
    (CVE-2026-78662)

    rclone versions >= v1.72.0 and <= v1.74.4 (fixed in v1.75.0) contain multiple denial-of-service     vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs     dependency. The parser fails to validate attacker-controlled superblock and metadata values before use. An     attacker who can place or modify a SquashFS image in storage exposed through an rclone :archive: remote     can craft a malicious image that triggers an integer division-by-zero panic (zero block size), an out-of-     bounds slice panic (out-of-range inode metadata offset), or a non-progress CPU loop (truncated metadata     stream). Variants 1 and 2 terminate the rclone process and, via 'rclone serve sftp', can crash the entire     SFTP server; variant 3 causes sustained CPU consumption. Parsing is lazy, so a victim or remote client     must address or descend into the malicious archive object to trigger it. (CVE-2026-79775)

    rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed     authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint     unauthenticated to retrieve the full process argv including backend credentials. (CVE-2026-79776)

    rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers     can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.
    (CVE-2026-79777)

    rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that     dereferences a nil response before checking for transport errors. A malicious or compromised configured     endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered     goroutines and halts unrelated work in long-lived processes. (CVE-2026-79778)

    rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic     authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP     redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform     WebDAV operations with the compromised account's permissions. (CVE-2026-79779)

    rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect     callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network     traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades     or SSE-C keys on cross-origin redirects to access protected S3 objects. (CVE-2026-79780)

    rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and     overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with     object keys like ../root-secret.txt to escape the bucket namespace and access files in the serve root     directory. (CVE-2026-79781)

    rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme     from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS     session tokens sent in request headers. (CVE-2026-79782)

    rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in     the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying     with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates     privileges to root if rclone runs as root, or to the service account user otherwise. (CVE-2026-79783)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers     or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows redirects     without a backend-specific http.Client.CheckRedirect policy. A configured remote that redirects to another     host can therefore cause custom secrets such as X-Api-Key to be resent to that untrusted destination, and     a same-host HTTPS-to-HTTP redirect can expose Authorization or Cookie headers in cleartext. Listing, stat,     download, mount, and serve operations can trigger the leak during normal use. This issue is fixed in     version 1.75.1. (CVE-2026-88013)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).readZip in     backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and     exposes cleaned entry names without ensuring that they remain inside the archive namespace. Entries such     as ../../etc/cron.d/evil can survive path.Clean and become Object.Remote() values that fs/sync and     fs/operations use as destination-relative paths, allowing rclone copy or sync to write outside the     selected destination on backends that do not independently confine the path. The non-empty root check also     used strings.HasPrefix without a path boundary, so root foo could incorrectly include sibling foobar     entries. This issue is fixed in version 1.75.1. (CVE-2026-88014)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as     .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through     Object.Open and openTranslatedLink. The function slices the target string as linkdst[offset:], so a Range     start larger than the target length causes a deterministic slice-bounds panic when lib/http/serve exposes     the object through HTTP or WebDAV. Go net/http normally recovers the panic per connection, causing     request-level denial of service rather than terminating the entire process. This issue is fixed in version     1.75.1. (CVE-2026-88015)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a     symlink in the destination and later directory metadata is applied through that path. MkdirMetadata,     writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os.Chmod,     os.Chtimes, and birth-time handling can bypass os.Root confinement and follow the symlink. An attacker     controlling source contents can therefore apply selected ownership, permissions, modification times, or     birth times to a file or directory outside the destination, with --metadata required for chmod and chown     while modification time is applied by the normal directory workflow. This issue is fixed in version     1.75.1. (CVE-2026-88016)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured     password per username in the server-wide userPass map[string]string instead of binding the credential or     VFS to the authenticated session. If two accepted credentials use the same username but resolve to     different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS     operations on the first session are reauthorized with the later password. The first session can then read,     create, overwrite, rename, or delete objects using the second credential's backend authority. Exploitation     requires the later same-username login to occur while the first session remains open. This issue is fixed     in version 1.75.1. (CVE-2026-88017)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows     authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then     verifies the request's SigV4 signature against that same empty secret, while Server.auth passes the access     key identifier as both the user and authentication value to the proxy without an independent per-identity     secret. An unauthenticated network attacker can therefore choose an arbitrary access key, sign with an     empty secret, and reach whatever backend the auth-proxy script resolves for that identity. This issue is     fixed in version 1.75.1. (CVE-2026-88018)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy     settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly     check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-     local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and     any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy.
    The dedicated command-line servers that configure the global option are not affected. This issue is fixed     in version 1.75.1. (CVE-2026-88044)

    rclone is a command-line program to sync files and directories to and from different cloud storage     providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source     Object.Remote() values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to     destination backends. A flat-keyspace source object store populated with native non-rclone tooling can     contain a raw .. key segment, and affected b2, swift, qingstor, oracleobjectstorage, internetarchive, smb,     storj, sftp, webdav, ftp, filelu, shade, and sia destinations use path.Join(root, remote) before EncodeDot     can neutralize the segment. A copy or upload can therefore escape the configured root into another bucket,     share, or path reachable by the victim credential, with sftp and smb potentially reaching other filesystem     or share locations under the same login authority. This issue is fixed in version 1.75.1. (CVE-2026-88046)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Rclone installed on the remote host is 1.64.x prior to 1.75.1. It is, therefore, affected by a cross-session backend confusion vulnerability:

  - The FTP auth-proxy driver stores one obscured password per username in a server-wide map and     does not bind the credential or the returned VFS to the authenticated FTP session. If two     accepted credentials use the same username but resolve to different proxy backends, the later     login overwrites the map entry, and subsequent operations on the first, still-authenticated     session are re-authorized with the later session's password and execute against the later     session's backend. A low-privileged user holding a valid auth-proxy credential can therefore     gain the read, write, and delete authority of another accepted credential sharing the same FTP     username. (CVE-2026-88017)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rclone is a command-line program to sync files and directories to and from different cloud storage
    providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured
    password per username in the server-wide userPass map[string]string instead of binding the credential or
    VFS to the authenticated session. If two accepted credentials use the same username but resolve to
    different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS
    operations on the first session are reauthorized with the later password. The first session can then read,
    create, overwrite, rename, or delete objects using the second credential’s backend authority. Exploitation
    requires the later same-username login to occur while the first session remains open. This issue is fixed
    in version 1.75.1. (CVE-2026-88017)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured     password per username in the server-wide userPass map[string]string instead of binding the credential or     VFS to the authenticated session. If two accepted credentials use the same username but resolve to     different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS     operations on the first session are reauthorized with the later password. The first session can then read,     create, overwrite, rename, or delete objects using the second credential's backend authority. Exploitation     requires the later same-username login to occur while the first session remains open. This issue is fixed     in version 1.75.1. (CVE-2026-88017)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
351086	Amazon Linux 2023 : rclone (ALAS2023-2026-3129)	Nessus	Amazon Linux Local Security Checks	Local	critical
346827	Rclone 1.64.x < 1.75.1 FTP Auth-Proxy Cross-Session Backend Confusion (CVE-2026-88017)	Nessus	Misc.	Local	high
447914	SCA: security update for github.com/rclone/rclone (GHSA-c476-6w5q-jw77)	Tenable Cloud Security	SCA Checks	Local	high
447914	SCA: security update for github.com/rclone/rclone (GHSA-c476-6w5q-jw77)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
344699	Linux Distros Unpatched Vulnerability : CVE-2026-88017	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-88017

high

Tenable Plugins

critical

high

high

high

high