Unrated

UBUNTU-CVE-2026-88017

Type: withdrawalSource: OSV1 source record

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the credential or VFS to the authenticated session. If two accepted credentials use the same username but resolve to different proxy backends, a later CheckPasswd login overwrites userPass[user], and subsequent getVFS operations on the first session are reauthorized with the later password. The first session can then read, create, overwrite, rename, or delete objects using the second credential’s backend authority. Exploitation requires the later same-username login to occur while the first session remains open. This issue is fixed in version 1.75.1.

Announced 10 Sept 2026Source revision 1

Original source ↗

UBUNTU-CVE-2026-88017

Primary source · Revision 1 · Withdrawn

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2026-88017

rclone

Source reference: /affected/0/package/name

Affected versions: 1.36-3
Source reference: /affected/0/versions
1.36-3ubuntu0.1
Source reference: /affected/0/versions
1.36-3ubuntu0.2
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

rclone

Source reference: /affected/1/package/name

Affected versions: 1.47.0+ex1-6
Source reference: /affected/1/versions
1.47.0+ex1-7
Source reference: /affected/1/versions
1.49.5-2
Source reference: /affected/1/versions
1.49.5-3
Source reference: /affected/1/versions
1.50.2-2
Source reference: /affected/1/versions
1.50.2-2ubuntu0.1
Source reference: /affected/1/versions
1.50.2-2ubuntu0.2
Source reference: /affected/1/versions
1.50.2-2ubuntu0.2+esm1
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

rclone

Source reference: /affected/2/package/name

Affected versions: 1.53.3-1
Source reference: /affected/2/versions
1.53.3-2
Source reference: /affected/2/versions
1.53.3-4
Source reference: /affected/2/versions
1.53.3-4ubuntu1
Source reference: /affected/2/versions
1.53.3-4ubuntu1.22.04.1
Source reference: /affected/2/versions
1.53.3-4ubuntu1.22.04.2
Source reference: /affected/2/versions
1.53.3-4ubuntu1.22.04.3
Source reference: /affected/2/versions
1.53.3-4ubuntu1.22.04.3+esm1
Source reference: /affected/2/versions
1.53.3-4ubuntu1.22.04.4
Source reference: /affected/2/versions
1.53.3-4ubuntu1.22.04.4+esm1
Source reference: /affected/2/versions
1.53.3-4ubuntu1.22.04.5
Source reference: /affected/2/versions
1.53.3-4ubuntu1.22.04.5+esm1
Source reference: /affected/2/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

rclone

Source reference: /affected/3/package/name

Affected versions: 1.60.1+dfsg-2build1
Source reference: /affected/3/versions
1.60.1+dfsg-3
Source reference: /affected/3/versions
1.60.1+dfsg-3ubuntu0.24.04.1
Source reference: /affected/3/versions
1.60.1+dfsg-3ubuntu0.24.04.2
Source reference: /affected/3/versions
1.60.1+dfsg-3ubuntu0.24.04.3
Source reference: /affected/3/versions
1.60.1+dfsg-3ubuntu0.24.04.4
Source reference: /affected/3/versions
1.60.1+dfsg-3ubuntu0.24.04.4+esm1
Source reference: /affected/3/versions
1.60.1+dfsg-3ubuntu0.24.04.5
Source reference: /affected/3/versions
1.60.1+dfsg-3ubuntu0.24.04.5+esm1
Source reference: /affected/3/versions
1.60.1+dfsg-3ubuntu0.24.04.6
Source reference: /affected/3/versions
1.60.1+dfsg-3ubuntu0.24.04.6+esm1
Source reference: /affected/3/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

rclone

Source reference: /affected/4/package/name

Affected versions: 1.60.1+dfsg-4ubuntu2
Source reference: /affected/4/versions
1.60.1+dfsg-4ubuntu3
Source reference: /affected/4/versions
1.60.1+dfsg-4ubuntu3.1
Source reference: /affected/4/versions
1.60.1+dfsg-4ubuntu3.1+esm1
Source reference: /affected/4/versions
1.60.1+dfsg-4ubuntu3.2
Source reference: /affected/4/versions
1.60.1+dfsg-4ubuntu3.2+esm1
Source reference: /affected/4/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "rclone",
      "purl": "pkg:deb/ubuntu/rclone?arch=source&distro=bionic",
      "ecosystem": "Ubuntu:18.04:LTS"
    },
    "versions": [
      "1.36-3",
      "1.36-3ubuntu0.1",
      "1.36-3ubuntu0.2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-88017.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "golang-github-ncw-rclone-dev",
          "binary_version": "1.36-3ubuntu0.2"
        },
        {
          "binary_name": "rclone",
          "binary_version": "1.36-3ubuntu0.2"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "rclone",
      "purl": "pkg:deb/ubuntu/rclone?arch=source&distro=esm-apps%2Ffocal",
      "ecosystem": "Ubuntu:Pro:20.04:LTS"
    },
    "versions": [
      "1.47.0+ex1-6",
      "1.47.0+ex1-7",
      "1.49.5-2",
      "1.49.5-3",
      "1.50.2-2",
      "1.50.2-2ubuntu0.1",
      "1.50.2-2ubuntu0.2",
      "1.50.2-2ubuntu0.2+esm1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-88017.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "golang-github-rclone-rclone-dev",
          "binary_version": "1.50.2-2ubuntu0.2+esm1"
        },
        {
          "binary_name": "rclone",
          "binary_version": "1.50.2-2ubuntu0.2+esm1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "rclone",
      "purl": "pkg:deb/ubuntu/rclone?arch=source&distro=esm-apps%2Fjammy",
      "ecosystem": "Ubuntu:Pro:22.04:LTS"
    },
    "versions": [
      "1.53.3-1",
      "1.53.3-2",
      "1.53.3-4",
      "1.53.3-4ubuntu1",
      "1.53.3-4ubuntu1.22.04.1",
      "1.53.3-4ubuntu1.22.04.2",
      "1.53.3-4ubuntu1.22.04.3",
      "1.53.3-4ubuntu1.22.04.3+esm1",
      "1.53.3-4ubuntu1.22.04.4",
      "1.53.3-4ubuntu1.22.04.4+esm1",
      "1.53.3-4ubuntu1.22.04.5",
      "1.53.3-4ubuntu1.22.04.5+esm1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-88017.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "golang-github-rclone-rclone-dev",
          "binary_version": "1.53.3-4ubuntu1.22.04.5+esm1"
        },
        {
          "binary_name": "rclone",
          "binary_version": "1.53.3-4ubuntu1.22.04.5+esm1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "rclone",
      "purl": "pkg:deb/ubuntu/rclone?arch=source&distro=esm-apps%2Fnoble",
      "ecosystem": "Ubuntu:Pro:24.04:LTS"
    },
    "versions": [
      "1.60.1+dfsg-2build1",
      "1.60.1+dfsg-3",
      "1.60.1+dfsg-3ubuntu0.24.04.1",
      "1.60.1+dfsg-3ubuntu0.24.04.2",
      "1.60.1+dfsg-3ubuntu0.24.04.3",
      "1.60.1+dfsg-3ubuntu0.24.04.4",
      "1.60.1+dfsg-3ubuntu0.24.04.4+esm1",
      "1.60.1+dfsg-3ubuntu0.24.04.5",
      "1.60.1+dfsg-3ubuntu0.24.04.5+esm1",
      "1.60.1+dfsg-3ubuntu0.24.04.6",
      "1.60.1+dfsg-3ubuntu0.24.04.6+esm1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-88017.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "golang-github-rclone-rclone-dev",
          "binary_version": "1.60.1+dfsg-3ubuntu0.24.04.6+esm1"
        },
        {
          "binary_name": "rclone",
          "binary_version": "1.60.1+dfsg-3ubuntu0.24.04.6+esm1"
        }
      ]
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "rclone",
      "purl": "pkg:deb/ubuntu/rclone?arch=source&distro=esm-apps%2Fresolute",
      "ecosystem": "Ubuntu:Pro:26.04:LTS"
    },
    "versions": [
      "1.60.1+dfsg-4ubuntu2",
      "1.60.1+dfsg-4ubuntu3",
      "1.60.1+dfsg-4ubuntu3.1",
      "1.60.1+dfsg-4ubuntu3.1+esm1",
      "1.60.1+dfsg-4ubuntu3.2",
      "1.60.1+dfsg-4ubuntu3.2+esm1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-88017.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "golang-github-rclone-rclone-dev",
          "binary_version": "1.60.1+dfsg-4ubuntu3.2+esm1"
        },
        {
          "binary_name": "rclone",
          "binary_version": "1.60.1+dfsg-4ubuntu3.2+esm1"
        }
      ]
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #13776 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:30:01 GMT
Publisher date: Thu, 10 Sep 2026 16:18:00 GMT

Read the original announcement