CVE-2026-88017

Name of the Vulnerable Software and Affected Versions rclone versions 1.64.0 through 1.75.0

Description The FTP auth-proxy driver in cmd/serve/ftp/ftp.go fails to bind credentials or the Virtual File System (VFS) to specific authenticated sessions. Instead, it stores one obscured password per username in a server-wide userPass map. If two different credentials use the same username but map to different proxy backends, a subsequent login with the same username will overwrite the existing entry in the userPass map. Consequently, any previously established session using that username will be re-authorized with the new password, allowing the first session to read, create, overwrite, rename, or delete objects using the authority of the second credential's backend. This session-isolation failure occurs when the getVFS() function retrieves the most recent password for a username rather than the one associated with the specific session. Exploitation requires a second login with the same username to occur while the first session remains open.

Recommendations Update rclone to version 1.75.1. As a temporary mitigation, restrict the use of the rclone serve ftp --auth-proxy command in environments where multiple distinct credentials may be used for the same username.