CVE-2026-88018 - rclone `serve s3` misconfiguration allows empty-secret SigV4 auth bypass via auth-proxy - Upwind | Cloud & AI Security for the Realtime Era

Security Feed

See the latest insights and analysis from our MDR team.

CVE-2026-88018

By Roy Kalfon |

12 September 2026

CVE-2026-88018 – rclone `serve s3` misconfiguration allows empty-secret SigV4 auth bypass via auth-proxy

In rclone `