{"action":"Upgrade github.com/rclone/rclone to 1.75.1 or later.","affected":[{"fixed":"1.75.1","introduced":"0"}],"component":"github.com/rclone/rclone","cve_ids":["CVE-2026-88018"],"ecosystem":"Go","epss":0.0051,"exploited":false,"fixed_versions":["1.75.1"],"ghsa_id":"GHSA-xwwr-4h3p-r22c","id":"tcs_01M5KGTVEPC3DW9AM64YCF2M1Q","modified_at":"2026-09-17T17:41:03.623612613Z","published_at":"2026-09-16T16:56:29Z","references":["https://osv.dev/vulnerability/GO-2026-6462","https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c","https://nvd.nist.gov/vuln/detail/CVE-2026-88018","https://github.com/rclone/rclone/commit/90595f34f27f569be6b27c57fe5ab65057d323bd","https://github.com/rclone/rclone/releases/tag/v1.75.1"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6462","url":"https://osv.dev/vulnerability/GO-2026-6462"}],"summary":"rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass in github.com/rclone/rclone"}