Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-88017, in rclone's FTP auth-proxy driver stemmed from a session isolation failure. Specifically, the ftp package maintained a global map (d.userPass) that stored obscured passwords, keyed only by username. This design flaw allowed a later login with the same username but a different credential to overwrite the password entry for that username in the global map. Consequently, any existing, still-authenticated FTP session sharing that username would then operate using the newly stored (and incorrect) credential, leading to unauthorized access to the later session's backend.
The CheckPasswd method was responsible for authenticating users and, upon success, storing the obscured password. The vulnerability arose because it stored this password in the global d.userPass map, making it susceptible to being overwritten by subsequent logins with the same username. The getVFS method, which is called for every filesystem operation, would then retrieve the password from this same global map. If the map had been overwritten by another session, getVFS would retrieve the wrong credential, causing the original session to execute commands against an unintended backend.
The patch addresses this by removing the global d.userPass map and instead storing the obscured password directly within the sctx.Sess.Data map, which is specific to each FTP session. This ensures that each session maintains its own authenticated credential, preventing cross-session confusion. Therefore, ftp.driver.CheckPasswd and ftp.driver.getVFS are the key vulnerable functions as they directly interacted with the flawed global state management.
ftp.driver.CheckPasswdcmd/serve/ftp/ftp.go
ftp.driver.getVFScmd/serve/ftp/ftp.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rclone/rclone | go | >= 1.64.0, <= 1.75.0 | 1.75.1 |