Description

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-10T17:17:08.387Z",
  "pubdate": "2026-09-10T17:17:08.387Z",
  "executiveSummary": "An authentication bypass vulnerability has been identified in the command-line cloud storage synchronization tool rclone, affecting versions from 1.70.0 up to (but not including) 1.75.1. The flaw resides within the remote control (RC) interface's \"serve/start\" functionality. When launching FTP or S3 servers via this interface, the application allows users to define request-local authentication proxy options (proxyOpt.AuthProxy). However, the underlying constructors fail to check this request-local variable, evaluating the process-global proxy.Opt.AuthProxy value instead. When the global option is left unconfigured (empty), the request-local authentication proxy is entirely ignored.\nThis failure leads to immediate security degradation depending on the protocol: FTP servers default to an open filesystem allowing access to the \"anonymous\" user with any password, while S3 servers with AuthKey enabled serve the fixed RC filesystem instead of the proxy-defined backend. This presents severe data confidentiality and integrity risks as unauthorized network actors can access filesystems without valid credentials. Dedicated command-line servers configuring the global option remain unaffected. Organizations utilizing rclone's RC interface are advised to apply the security update to version 1.75.1 immediately.",
  "technicalDetails": "The vulnerability stems from a scope resolution error between process-global configurations and request-local parameters within rclone's Remote Control (RC) server initiation flow. When an administrative entity calls the \"serve/start\" RC interface, the command processes individual configuration options for the target server instance, including the local proxyOpt.AuthProxy setting, which defines the authentication proxy backend.\nHowever, the server initialization logic fails to map this configuration correctly. Specifically, the FTP constructor inside \"cmd/serve/ftp/ftp.go\" and the S3 constructor inside \"cmd/serve/s3/server.go\" verify authentication proxy settings by reading the global configuration variable \"proxy.Opt.AuthProxy\" rather than the request-local \"proxyOpt.AuthProxy\" variable.\nWhen rclone is executed without globally defined authentication proxy parameters (which is typical when dynamically spawning servers via the RC interface), the global \"proxy.Opt.AuthProxy\" variable evaluates to empty. Consequently, the constructors determine that no authentication proxy is active, ignoring the request-local proxy settings altogether. This triggers insecure default behaviors for both protocols:\n1. FTP Fallback Behavior: When the authentication proxy is ignored, the FTP constructor falls back to a default filesystem configuration. This fallback mode permits authentication to any client supplying the username \"anonymous\" and an arbitrary password, granting unauthorized access to the underlying filesystem.\n2. S3 Fallback Behavior: When S3 is configured with AuthKey, the constructor is unable to route requests to the backend filesystem dynamically selected by the authentication proxy. Because the proxy configuration is bypassed, the server defaults to exposing and serving the static Remote Control (RC) filesystem directly.\nThe attack flow requires an attacker to identify an active FTP or S3 listener spawned via the vulnerable \"serve/start\" RC interface where the global proxy options were left unconfigured. Once identified, the attacker can establish an unauthenticated FTP session using \"anonymous\" credentials or query the S3 endpoint to gain direct access to the exposed filesystems. This vulnerability affects version 1.70.0 through version 1.75.0, and is fully resolved in version 1.75.1 by correcting the constructor validation logic to check the request-local proxy configuration."
}