GHSA-p569-5gjg-9cmj: rclone: RC per-server auth-proxy bypass
HIGHCritical vulnerability — CVSS 9.1
What to do
- Critical severity — schedule an urgent patch.
## Summary `serve/start` accepts protocol options in a per-server `proxyOpt` object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global `proxy.Opt.AuthProxy` instead of the supplied `proxyOpt.AuthProxy`. When the process-global option is empty—the normal case when only the RC request configures the server—the supplied authentication proxy is silently ignored. …
CVE · detail
- CVE-2026-88044nvd ↗EPSS 0.49%
● loading threat intel…
Early access
Get the next one first.
Early access opens the actor API and MCP server first, plus alerts when an adversary you follow lands on the wire. One email when it's ready. Nothing else, ever.
bot-protected