{"vulnerability": "ghsa-c476-6w5q-jw77", "sightings": [{"uuid": "929769c7-f45f-4378-bfda-12586aae9ab7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-c476-6w5q-jw77", "type": "seen", "source": "https://gist.github.com/alon710/bdeb340c6c170113e47b6e3cbfb5203b", "content": "# CVE-2026-88017: CVE-2026-88017: Cross-Session Authentication-Proxy Backend Confusion in rclone FTP Server\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-09-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88017\n\n## Summary\nThe FTP server implementation of rclone is vulnerable to a cross-session identity and credential confusion flaw when configured with an authentication proxy. Under specific multi-tenant configurations where multiple distinct sessions authenticate with the same username, a global map caches credentials globally instead of isolating them inside the session context. This allows a concurrent attacker to hijack the active session backend of a victim using the same username.\n\n## TL;DR\nA global credential map in rclone's FTP auth-proxy driver allows an attacker sharing a generic username to hijack a victim's concurrent FTP session storage backend.\n\n## Technical Details\n\n- **CWE ID**: CWE-488 (Exposure of Data Element to Wrong Session)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.3 (High)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact**: Complete Cross-Session Information Disclosure and File Integrity Compromise\n\n## Affected Systems\n\n- rclone FTP server configurations utilizing the --auth-proxy option\n\n## Mitigation\n\n- Upgrade rclone to version 1.75.1 or newer to ensure session isolation.\n- Configure the authentication proxy script to guarantee unique usernames for all connecting clients.\n- Deactivate the --auth-proxy flag on exposed FTP server instances if unique usernames cannot be enforced.\n\n**Remediation Steps:**\n1. Verify the running version of rclone using the command: rclone version.\n2. Locate and download the appropriate patch release of rclone (v1.75.1+) from the official releases archive.\n3. Replace the old rclone binary on the target system and restart the serve ftp daemon processes.\n4. Verify that the driver-global cache has been eliminated by reviewing system configurations and checking the active session state logic.\n\n## References\n\n- [GitHub Security Advisory GHSA-c476-6w5q-jw77](https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77)\n- [rclone Fix Commit c6af0b57c2b4af848bc968c2b407354476184b99](https://github.com/rclone/rclone/commit/c6af0b57c2b4af848bc968c2b407354476184b99)\n- [rclone v1.75.1 Release Page](https://github.com/rclone/rclone/releases/tag/v1.75.1)\n- [NVD CVE-2026-88017 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-88017)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88017) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-11T11:09:30.425407Z"}]}