CVE-2026-88017

rclone versions 1.64.0 through 1.75.0 contain a credential-handling flaw in the FTP auth-proxy driver (cmd/serve/ftp/ftp.go): the server keeps a single obscured password per username in a server-wide map instead of binding each credential and VFS to its authenticated session. If a second login uses the same username with a different password that the auth proxy resolves to a different backend while the first session is still open, the later CheckPasswd overwrites the stored entry and the first session's subsequent getVFS operations are reauthorized against the later password. The first session then operates with the second credential's backend authority, allowing its holder to read, create, overwrite, rename, or delete objects in the other backend — a cross-session authorization bypass with high confidentiality and integrity impact. Only deployments running 'rclone serve ftp' with --auth-proxy, where credentials sharing a username can resolve to different backends, are affected, and exploitation additionally requires the overlapping same-username login. No exploitation has been reported (not in CISA KEV, no public PoC), and the issue is fixed in rclone 1.75.1.

What to do: Upgrade to rclone 1.75.1 or later, which binds credentials to the authenticated session. If upgrading immediately is not possible, avoid reusing the same username across different auth-proxy backends (or prevent overlapping logins with the same username) and restrict FTP service exposure with firewall/VPN controls; review logs for concurrent logins with identical usernames resolving to multiple backends to assess past impact.