rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the credential or VFS to the authenticated session. If two accepted credentials use the same username but resolve to different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS operations on the first session are reauthorized with the later password. The first session can then read, create, overwrite, rename, or delete objects using the second credential’s backend authority. Exploitation requires the later same-username login to occur while the first session remains open. This issue is fixed in version 1.75.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rclone is a command-line program to sync files and directories to and from different cloud storage
    providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured
    password per username in the server-wide userPass map[string]string instead of binding the credential or
    VFS to the authenticated session. If two accepted credentials use the same username but resolve to
    different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS
    operations on the first session are reauthorized with the later password. The first session can then read,
    create, overwrite, rename, or delete objects using the second credential’s backend authority. Exploitation
    requires the later same-username login to occur while the first session remains open. This issue is fixed
    in version 1.75.1. (CVE-2026-88017)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rclone is a command-line program to sync files and directories to and from different cloud storage     providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured     password per username in the server-wide userPass map[string]string instead of binding the credential or     VFS to the authenticated session. If two accepted credentials use the same username but resolve to     different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS     operations on the first session are reauthorized with the later password. The first session can then read,     create, overwrite, rename, or delete objects using the second credential's backend authority. Exploitation     requires the later same-username login to occur while the first session remains open. This issue is fixed     in version 1.75.1. (CVE-2026-88017)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
447914	SCA: security update for github.com/rclone/rclone (GHSA-c476-6w5q-jw77)	Tenable Cloud Security	SCA Checks	Local	high
447914	SCA: security update for github.com/rclone/rclone (GHSA-c476-6w5q-jw77)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
344699	Linux Distros Unpatched Vulnerability : CVE-2026-88017	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-88017

high

Tenable Plugins

high

high

high