Detections
Analytics

SCA: security update for github.com/rclone/rclone (GHSA-p569-5gjg-9cmj)

critical Tenable Cloud Security Plugin ID 447953

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - rclone is a command-line program to sync files and directories to and from different cloud storage
 providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy
 settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly
 check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-
 local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and
 any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy.
 The dedicated command-line servers that configure the global option are not affected. This issue is fixed
 in version 1.75.1. (CVE-2026-88044)

Solution

Update the github.com/rclone/rclone library and its related packages to version 1.75.1 or later.

See Also

https://github.com/advisories/GHSA-p569-5gjg-9cmj

Plugin Details

Severity: Critical

ID: 447953

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/11/2026

Updated: 9/11/2026

Risk Information

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-88044

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/10/2026

Vulnerability Publication Date: 9/10/2026

Reference Information

CVE: CVE-2026-88044

cwe: CWE-863