•6 minutes ago•CVE-2026-88017
7.3CVE-2026-88017: Cross-Session Authentication-Proxy Backend Confusion in rclone FTP Server
The FTP server implementation of rclone is vulnerable to a cross-session identity and credential confusion flaw when configured with an authentication proxy. Under specific multi-tenant configurations where multiple distinct sessions authenticate with the same username, a global map caches credentials globally instead of isolating them inside the session context. This allows a concurrent attacker to hijack the active session backend of a victim using the same username.
0 views•7 min read
•about 1 hour ago•CVE-2026-88044
9.1CVE-2026-88044: Authentication Bypass in rclone Dynamic Server Execution via Remote Control API
An authentication bypass vulnerability exists in rclone when dynamically starting FTP, S3, or SFTP servers via the Remote Control (RC) 'serve/start' API. The server constructors incorrectly check the global process configuration rather than request-scoped options, resulting in a silent bypass of the authentication proxy and enabling unauthenticated access.
1 views•6 min read
•about 2 hours ago•CVE-2026-88018
9.8CVE-2026-88018: Authentication Bypass in rclone S3 Server Component via Empty HMAC Secret
Prior to version 1.75.1, rclone's S3 server component ('rclone serve s3') contains an authentication bypass vulnerability when configured with '--auth-proxy' but without '--auth-key'. The application validates AWS Signature Version 4 (SigV4) against an empty secret key string, enabling unauthenticated remote attackers to access storage backends.
4 views•6 min read
•about 3 hours ago•CVE-2026-88015
5.3CVE-2026-88015: Request-Level Denial of Service via Go Slice Bounds Panic in rclone Local Backend
A request-level denial of service vulnerability exists in rclone versions prior to 1.75.1 when configured with local symlink virtualization (--links) and serving files over HTTP or WebDAV. An unauthenticated remote attacker can trigger a Go runtime slice bounds panic by sending a crafted HTTP Range request with an offset exceeding the path length of the target symlink.
5 views•6 min read
•about 4 hours ago•CVE-2026-88013
3.7CVE-2026-88013: Sensitive Header Leakage via Unvalidated HTTP Redirects in rclone
rclone versions from 1.49.0 up to 1.75.1 are vulnerable to information disclosure and credential leakage. When configuring custom headers on HTTP connections, rclone fails to strip those headers when following HTTP redirects to external untrusted domains. Additionally, rclone does not prevent scheme downgrades from HTTPS to HTTP on same-host redirects, allowing sensitive standard credentials to be transmitted in cleartext.
4 views•7 min read
•about 5 hours ago•CVE-2026-88014
6.3CVE-2026-88014: Path Traversal (Zip Slip) and Directory Boundary Bypass in rclone ZIP Backend
A critical path traversal vulnerability (commonly known as 'Zip Slip') exists in rclone's ZIP archive backend implementation (backend/archive/zip/zip.go) between versions 1.72.0 and 1.75.1. The flaw allows an attacker to write arbitrary files outside the designated extraction directory by supplying a maliciously crafted ZIP archive. Additionally, the backend's directory boundary verification routine failed to enforce strict path limits, causing sibling folders sharing a name prefix to match incorrectly and leading to unauthorized data exposure. This issue has been fully resolved in version 1.75.1.
6 views•5 min read
•about 6 hours ago•CVE-2026-88009
8.8CVE-2026-88009: HTTP Request Smuggling and Authorization Bypass via Opaque Target Processing in Traefik
An architectural parser-differential vulnerability in Traefik's routing engine allows unauthenticated attackers to bypass path-based routing rules, authentication middleware, and access logs. The issue stems from inconsistencies in handling rootless/opaque request targets between Go's standard net/http parser and Traefik's internal routing and sanitization layers. This vulnerability compromises the authorization boundary of upstream microservices.
5 views•7 min read
•about 7 hours ago•CVE-2026-88007
9.1CVE-2026-88007: Connection Hijacking and Unauthorized Session Reuse in Traefik HTTP/3 Proxying
CVE-2026-88007 is a critical vulnerability in Traefik where connection-bound backend authentication (like NTLM or Kerberos) is compromised over HTTP/3. Due to an uninitialized connection transport context, authenticated TCP sockets from a victim are leaked into a globally shared pool and subsequently reused by unrelated clients, leading to unauthenticated session hijacking.
6 views•7 min read
•about 8 hours ago•CVE-2026-88004
7.0CVE-2026-88004: Security Bypass in Traefik Entrypoint Protections via Smuggled Request Trailers
An interpretation conflict and security bypass vulnerability in the entrypoint security mechanisms of Traefik allows unauthenticated remote attackers to bypass header-name sanitization and strip/reject policies. By smuggling sensitive, protected, or trusted header names inside an HTTP/1.1 chunked trailer or an HTTP/2 trailer, attackers can bypass Traefik's security defenses if a downstream backend merges trailers into the header namespace.
5 views•5 min read
•about 9 hours ago•CVE-2026-88008
7.0CVE-2026-88008: Middleware Security Bypass via Unencrypted HTTP/2 (h2c) Connection Upgrades in Traefik
An architectural flaw in the Traefik reverse proxy allows unauthenticated remote attackers to bypass security middlewares (such as basic authentication, IP allowlists, and forward authorization) by initiating an unencrypted HTTP/2 (h2c) upgrade request, causing the proxy to transition the connection into an opaque bi-directional TCP tunnel.
6 views•6 min read
•about 10 hours ago•CVE-2026-88006
6.5CVE-2026-88006: Incorrect Authorization in Open WebUI OAuth Token Exchange
An incorrect authorization vulnerability in Open WebUI allows users to bypass Identity Provider (IdP) role revocations and demotions. Prior to version 0.11.1, the OAuth token exchange endpoint failed to execute user synchronization and group mapping checks, enabling users with active provider tokens to establish sessions with their cached, stale database roles.
3 views•6 min read
•about 11 hours ago•CVE-2026-88016
7.1CVE-2026-88016: Arbitrary Filesystem Metadata Modification and Directory Traversal in rclone
CVE-2026-88016 is a high-severity directory traversal and arbitrary metadata modification vulnerability in rclone versions prior to 1.75.1. When synchronizing directories with the `--links` and `--metadata` flags, rclone fails to apply sandboxing to directory metadata operations, leading to symbolic link following that allows modification of arbitrary files outside the target destination.
5 views•7 min read