rclone RC 'serve/start' Auth-Proxy Bypass Lets FTP/S3 Requests Skip Configured Authentication (CVE-2026-88044)

What happened

A GitHub Security Advisory (GHSA-p569-5gjg-9cmj) discloses that rclone's Remote Control (RC) serve/start API accepts a per-request proxyOpt.AuthProxy setting for FTP and S3 servers, but the FTP and S3 server constructors check the process-global proxy.Opt.AuthProxy instead of the value actually supplied in the request. When only the RC request configures an auth proxy (the global option is empty), that check fails and both protocols silently fall back to a fixed-backend mode: FTP defaults to accepting username anonymous with any password, and S3 serves the fixed filesystem instead of routing through the configured proxy backend. Confirmed affected versions are rclone v1.70.0 through v1.75.0 (plus one development commit); CLI-started servers using the global option are not affected. The advisory includes working proof-of-concept reproductions for both the FTP authentication bypass and the S3 backend-routing bypass, and rates the issue 9.1 CVSS with a public PoC (CVE-2026-88044).

Why it matters

This affects any operator using rclone's RC API to start FTP or S3 servers with a per-server auth proxy — a pattern used for multi-tenant or dynamically-configured serving setups. For FTP, the impact is a complete authentication bypass: an unauthenticated network client can read, write, and delete files in the exposed filesystem. For S3, an attacker holding any valid access key accepted by the server can be routed to the wrong backend filesystem, resulting in cross-tenant disclosure or modification rather than the isolation the proxy was meant to enforce. Because the option is documented and parsed without error, operators have no obvious signal that their configured auth proxy isn't actually taking effect.

What defenders should watch for now

• Inventory any use of rclone's RC serve/start endpoint for FTP or S3, especially where proxyOpt.AuthProxy is set per-request rather than via a global CLI flag.
• Check rclone version — confirm affected range v1.70.0–v1.75.0 and prioritize patching or upgrading once a fix lands.
• Hunt for unexpected FTP logins using the anonymous account, or FTP sessions on RC-started servers that never invoke the configured external auth-proxy process/script.
• For S3, review logs for API calls authenticated with valid keys that returned objects inconsistent with the expected per-key backend routing (i.e., data that should have been isolated to a different tenant/backend).
• As a mitigation until patched, avoid combining RC-started per-server proxy auth with network-exposed listeners; prefer CLI-invoked servers where the global auth-proxy option is honored correctly, or restrict RC-served FTP/S3 endpoints to trusted networks.

Developing intel

This is a same-day advisory publication and details may be refined as rclone maintainers respond and a fix version is released. Treat the affected-version range and remediation guidance in the original advisory as authoritative; see GHSA-p569-5gjg-9cmj for full technical detail and proof-of-concept code.