Improper Authentication in rclone - #VU147298
Published: September 7, 2026
Vulnerability identifier: #VU147298
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication and access backend resources as an authenticated user.
The vulnerability exists due to improper authentication in the rclone serve s3 authPairMiddleware when an auth proxy is configured without an auth key. A remote attacker can send a SigV4-signed request using an empty secret to bypass authentication and access backend resources as an authenticated user.
The auth-proxy script does not receive an independent secret to verify for S3 requests.
Affected software
rclone
Remediation
Install security update from vendor's website.
rclone - update to 1.75.1