rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-88018 · CVE overview and exploitation status

EUVD-2026-75585

GHSA-xwwr-4h3p-r22c

BIT-rclone-2026-88018

GO-2026-6462

cve-program · CVE-2026-88018

• https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c
• https://github.com/rclone/rclone/commit/90595f34f27f569be6b27c57fe5ab65057d323bd
• https://github.com/rclone/rclone/releases/tag/v1.75.1

euvd · EUVD-2026-75585

• https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c
• https://github.com/rclone/rclone/commit/90595f34f27f569be6b27c57fe5ab65057d323bd
• https://github.com/rclone/rclone/releases/tag/v1.75.1

nvd · CVE-2026-88018

• https://github.com/rclone/rclone/commit/90595f34f27f569be6b27c57fe5ab65057d323bd
• https://github.com/rclone/rclone/releases/tag/v1.75.1
• https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c

osv · GHSA-xwwr-4h3p-r22c

• https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c
• https://nvd.nist.gov/vuln/detail/CVE-2026-88018
• https://github.com/rclone/rclone/commit/90595f34f27f569be6b27c57fe5ab65057d323bd
• https://github.com/rclone/rclone
• https://github.com/rclone/rclone/releases/tag/v1.75.1

osv · GO-2026-6462

• https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c
• https://nvd.nist.gov/vuln/detail/CVE-2026-88018
• https://github.com/rclone/rclone/commit/90595f34f27f569be6b27c57fe5ab65057d323bd
• https://github.com/rclone/rclone/releases/tag/v1.75.1

No related changes are available here.