{"vulnerability": "cve-2026-88017", "sightings": [{"uuid": "f3d4b07e-c0d2-4e60-b98d-a1e2b1559b21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88017", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77", "content": "", "creation_timestamp": "2026-09-11T00:35:23.258003Z"}, {"uuid": "c07d82cb-7c2c-4a7d-90e5-9363c9c4e428", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88017", "type": "seen", "source": "https://gist.github.com/alon710/bdeb340c6c170113e47b6e3cbfb5203b", "content": "# CVE-2026-88017: CVE-2026-88017: Cross-Session Authentication-Proxy Backend Confusion in rclone FTP Server\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-09-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88017\n\n## Summary\nThe FTP server implementation of rclone is vulnerable to a cross-session identity and credential confusion flaw when configured with an authentication proxy. Under specific multi-tenant configurations where multiple distinct sessions authenticate with the same username, a global map caches credentials globally instead of isolating them inside the session context. This allows a concurrent attacker to hijack the active session backend of a victim using the same username.\n\n## TL;DR\nA global credential map in rclone's FTP auth-proxy driver allows an attacker sharing a generic username to hijack a victim's concurrent FTP session storage backend.\n\n## Technical Details\n\n- **CWE ID**: CWE-488 (Exposure of Data Element to Wrong Session)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.3 (High)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact**: Complete Cross-Session Information Disclosure and File Integrity Compromise\n\n## Affected Systems\n\n- rclone FTP server configurations utilizing the --auth-proxy option\n\n## Mitigation\n\n- Upgrade rclone to version 1.75.1 or newer to ensure session isolation.\n- Configure the authentication proxy script to guarantee unique usernames for all connecting clients.\n- Deactivate the --auth-proxy flag on exposed FTP server instances if unique usernames cannot be enforced.\n\n**Remediation Steps:**\n1. Verify the running version of rclone using the command: rclone version.\n2. Locate and download the appropriate patch release of rclone (v1.75.1+) from the official releases archive.\n3. Replace the old rclone binary on the target system and restart the serve ftp daemon processes.\n4. Verify that the driver-global cache has been eliminated by reviewing system configurations and checking the active session state logic.\n\n## References\n\n- [GitHub Security Advisory GHSA-c476-6w5q-jw77](https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77)\n- [rclone Fix Commit c6af0b57c2b4af848bc968c2b407354476184b99](https://github.com/rclone/rclone/commit/c6af0b57c2b4af848bc968c2b407354476184b99)\n- [rclone v1.75.1 Release Page](https://github.com/rclone/rclone/releases/tag/v1.75.1)\n- [NVD CVE-2026-88017 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-88017)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88017) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-11T11:09:30.334343Z"}, {"uuid": "8711f2da-ebc6-4fd6-b474-67ad30f91e74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88017", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rclone-poc-pubblici-per-lo-sfruttamento-delle-cve-2026-88018-cve-2026-88044-cve-2026-88045-cve-2026-88016-e-cve-2026-88017", "content": "Disponibili Proof of Concept (PoC) per le CVE-2026-88018, CVE-2026-88044, CVE-2026-88045, CVE-2026-88016 e CVE-2026-88017 - gi\u00e0 sanate dal vendor - presenti in Rclone.", "creation_timestamp": "2026-09-11T16:00:46.902358Z"}, {"uuid": "047bd43e-f6bf-45f7-961a-b0ee4cb12538", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88017", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rclone-poc-pubblici-per-lo-sfruttamento-delle-cve-2026-88018-cve-2026-88044-cve-2026-88045-cve-2026-88016-e-cve-2026-88017", "content": "Disponibili Proof of Concept (PoC) per le CVE-2026-88018, CVE-2026-88044, CVE-2026-88045, CVE-2026-88016 e CVE-2026-88017 - gi\u00e0 sanate dal vendor - presenti in Rclone.", "creation_timestamp": "2026-09-12T01:00:39.704108Z"}]}