CVE-2026-88017
Description
A flaw was found in rclone, a command-line program for syncing files to cloud storage providers. The FTP authentication proxy driver improperly handles user credentials across sessions. If two users share the same username but are linked to different storage backends, a later login can overwrite the authentication for an active session. This allows the first session to perform unauthorized data operations, including reading, creating, or deleting files, using the second user's permissions.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To mitigate this issue, ensure that all usernames configured across different rclone FTP auth-proxy backends are unique. If the FTP auth-proxy functionality is not required, consider disabling or not enabling it to prevent exposure.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
