---
id: CVE-2026-88017
title: >-
  rclone is a command-line program to sync files and directories to and from
  different cloud storage providers
summary: >-
  rclone is a command-line program to sync files and directories to and from
  different cloud storage providers. From 1.64.0 until 1.75.1, the FTP
  auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per
  username in the se…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-488
vendor: rclone
product: rclone
affected:
  - 'rclone >= 1.64.0, < 1.75.1'
patched:
  - rclone 1.75.1
published: '2026-09-10'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T20:00:53.363'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88017'
references:
  - url: >-
      https://github.com/rclone/rclone/commit/c6af0b57c2b4af848bc968c2b407354476184b99
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/releases/tag/v1.75.1'
    label: security-advisories@github.com
  - url: 'https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88017'
  - url: 'https://github.com/rclone/rclone'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88017.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-88017'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-88017'
tags:
  - nvd
  - cve.org
  - osv
  - go
  - csaf
  - vex
  - red-hat
epss: 0.00425
epssPercentile: 0.34093
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-11T16:48:39.156188Z'
ingestedAt: '2026-09-14T11:11:19.881Z'
aliases:
  - GHSA-c476-6w5q-jw77
  - BIT-rclone-2026-88017
  - GO-2026-6458
ecosystem: go
scores:
  nvd: 7.3
  vendor: 9
---

## Overview

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the credential or VFS to the authenticated session. If two accepted credentials use the same username but resolve to different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS operations on the first session are reauthorized with the later password. The first session can then read, create, overwrite, rename, or delete objects using the second credential’s backend authority. Exploitation requires the later same-username login to occur while the first session remains open. This issue is fixed in version 1.75.1.

## Affected

- `rclone >= 1.64.0, < 1.75.1`

## Remediation

Upgrade past the affected range:

- `rclone 1.75.1`

## Package advisory (CVE-2026-88017)

Affected packages:

- `github.com/rclone/rclone >= 1.64.0, < 1.75.1`

Patched in:

- `github.com/rclone/rclone 1.75.1`

Source: https://osv.dev/vulnerability/GHSA-c476-6w5q-jw77

## Vendor advisories

- **Red Hat VEX** · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88017.json)