CSIRT-ITA says public proof-of-concept code now exists for five patched Rclone vulnerabilities, including CVE-2026-88018, a CVSS 9.8 authentication-bypass in the S3 service mode. The advisory covers bugs that can let a remote attacker skip login, bypass security checks, or trigger denial of service.
The auth-bypass lands when Rclone's S3 service is run with `--auth-proxy` but no `--auth-key`: signed requests can be accepted with the wrong trust check, so the service may treat an unauthenticated client as authorized. Other flaws can exhaust memory during multipart uploads or abuse symlink handling, which means the impact ranges from exposed files to a knocked-over service.
For operators exposing Rclone as a remote file endpoint, the exposure is not abstract sync logic but a reachable service front door. If an instance is still unpatched, public PoCs make both access-control failure and outage more practical outcomes than a theoretical bug report.
CVSS 7.5 HIGH: rclone is a command-line program to sync files and directories to and from different cloud storage providers. EPSS 0.6% (48th percentile).
CVSS 9.8 CRITICAL: rclone is a command-line program to sync files and directories to and from different cloud storage providers. EPSS 0.5% (41st percentile).
CVSS 9.1 CRITICAL: rclone is a command-line program to sync files and directories to and from different cloud storage providers. EPSS 0.5% (40th percentile).
CVSS 7.3 HIGH: rclone is a command-line program to sync files and directories to and from different cloud storage providers. EPSS 0.2% (13th percentile).
CVSS 7.1 HIGH: rclone is a command-line program to sync files and directories to and from different cloud storage providers. EPSS 0.2% (7th percentile).
Rclone: PoC pubblici per lo sfruttamento delle CVE-2026-88018, CVE-2026-88044, CVE-2026-88045, CVE-2026-88016 e CVE-2026-88017
Disponibili Proof of Concept (PoC) per le CVE-2026-88018, CVE-2026-88044, CVE-2026-88045, CVE-2026-88016 e CVE-2026-88017 - già sanate dal vendor - presenti in Rclone.