Technical impact
Authentication middleware in rclone serve s3 incorrectly accepts any client-selected accessKeyID when the --auth-key option is omitted; the middleware registers this key with an empty secret, and the underlying gofakes3 service verifies the SigV4 signature against that empty secret. The proxy then passes the same access key identifier as both user and authentication value to the downstream backend to sign requests with a blank secret and obtain access to whatever backend the auth‑proxy script resolves for that identity. This flaw is a classic authentication represents an unauthorized configuration error (CWE‑306).
Affected Systems
The vulnerability affects the rclone command‑line serve s3 configured with the --auth‑proxy flag but without the --auth‑key flag, for all releases prior to version 1.75.1. The bug was fixed in rclone v1.75.1, so any installation of rclone older than that is impacted.
Risk and Exploitability
The flaw carries a CVSS score of 9.8, indicating a severe risk. The EPSS score is not available, but the lack of a KEV listing does not diminish the vulnerability’s impact. An attacker only needs network reach to the rclone‑hosted S3 endpoint; a typical exploit would involve sending a SigV4‑signed request with an empty key value, which the server will accept and forward to the configured backend. The exploit path requires no elevated privileges on the rclone host and no exploitation of additional software components. Given the severity score, administrators should treat the risk as high and remediate promptly.
Github GHSA