{"vulnerability": "cve-2026-8801", "sightings": [{"uuid": "b3823897-89ea-485b-ad69-3dae4b5e81a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8801", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq65cl2ju42g", "content": "CVE-2026-8801 - File Extension Restriction Bypass in MOVEit Transfer\nCVE ID : CVE-2026-8801\n \n Published : July 8, 2026, 8:17 p.m. | 43\u00a0minutes ago\n \n Description : Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules).\n\nThis issue affects MOVEit Tr...", "creation_timestamp": "2026-07-08T22:13:28.021990Z"}, {"uuid": "dc5f804c-212c-43ef-99fe-785d7bd26223", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8801", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqaeg6yw7v2h", "content": "CVE-2026-8801 - moveit_transfer\nMOVEit Transfer, a file transfer software, has a security weakness in its file upload module. This vulnerability can allow unauthorized access to the system,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#moveittransfer #progress #CVE #infosec", "creation_timestamp": "2026-07-09T19:26:04.745834Z"}, {"uuid": "0d9e021b-547f-4db3-b1c0-8425152271ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8801", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116897438967441627", "content": "A lot of offensive activities were identified targeting Progress MOVEit Transfer (CVE-2026-8801) https://vuldb.com/vuln/376996/cti", "creation_timestamp": "2026-07-10T19:56:03.636076Z"}, {"uuid": "74a33594-eba0-402b-8465-33bc585b5f5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv6lcu5vv52j", "content": "CVE-2026-88018 - rclone\nIf you use rclone\u2019s S3 server feature with the auth-proxy option but forget to set an auth-key, an attacker on the network can pretend to be any user and gain access to the storage backend.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rclone #CVE #infosec", "creation_timestamp": "2026-09-10T17:30:08.090263Z"}, {"uuid": "951a1308-b429-4585-b971-794150ce3555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv6nhoohgn2n", "content": "\ud83d\udea8 CVE-2026-88018 \u2014 CVSS 9.8 CRITICAL\n\nrclone is a command-line program to sync files and directories to and from different cloud storage provider...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-88018\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-10T18:08:36.893464Z"}, {"uuid": "eae7a52d-256a-4150-ae27-e9b22971a62b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mv6lu5v56m2q", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-10T17:39:48.385130Z"}, {"uuid": "8b7491fc-c03e-4f17-aa43-25b94ca62453", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mv6st3zh5y2w", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-10T19:44:29.022192Z"}, {"uuid": "8e9e2b8e-eec8-48ad-8181-5be66050f400", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88011", "type": "published-proof-of-concept", "source": "https://github.com/traefik/traefik/security/advisories/GHSA-rf44-j88r-hh8c", "content": "", "creation_timestamp": "2026-09-10T22:35:10.070587Z"}, {"uuid": "d11a29a1-91f7-487e-9f25-3b4bf0459f36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88012", "type": "published-proof-of-concept", "source": "https://github.com/traefik/traefik/security/advisories/GHSA-7ghq-v6jf-g56c", "content": "", "creation_timestamp": "2026-09-10T22:35:12.233020Z"}, {"uuid": "633f1c85-c542-4920-bb42-1b82f1615c0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88014", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-66hp-wgxq-6f5q", "content": "", "creation_timestamp": "2026-09-11T00:35:12.326154Z"}, {"uuid": "26a3a8ad-77e1-455d-b8dc-8e8e64d680c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88016", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-f8g7-2xjc-7mfh", "content": "", "creation_timestamp": "2026-09-11T00:35:14.496987Z"}, {"uuid": "dc445923-3430-41ca-a7c6-09b77777cd32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88015", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-p6m2-r3w9-mpxw", "content": "", "creation_timestamp": "2026-09-11T00:35:16.685201Z"}, {"uuid": "70fefdae-35be-46f1-b8cb-db18afa3d116", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88018", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c", "content": "", "creation_timestamp": "2026-09-11T00:35:18.890159Z"}, {"uuid": "f3d4b07e-c0d2-4e60-b98d-a1e2b1559b21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88017", "type": "published-proof-of-concept", "source": "https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77", "content": "", "creation_timestamp": "2026-09-11T00:35:23.258003Z"}, {"uuid": "46e6541a-8529-4fe0-8c37-c091f0ff0754", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mv7p57om4v2p", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-11T04:11:12.846442Z"}, {"uuid": "eb586ebf-6a92-402e-a680-cf18b73cb457", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mv7wdg6ps62t", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-11T06:19:57.562891Z"}, {"uuid": "48596761-6ab8-4235-a605-9d88c5aba386", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvaat5dll52i", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-11T09:27:43.146807Z"}, {"uuid": "20a620e6-653a-4792-a41c-856bb2093bd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvaegtg4xj24", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-11T10:32:25.326763Z"}, {"uuid": "c07d82cb-7c2c-4a7d-90e5-9363c9c4e428", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88017", "type": "seen", "source": "https://gist.github.com/alon710/bdeb340c6c170113e47b6e3cbfb5203b", "content": "# CVE-2026-88017: CVE-2026-88017: Cross-Session Authentication-Proxy Backend Confusion in rclone FTP Server\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-09-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88017\n\n## Summary\nThe FTP server implementation of rclone is vulnerable to a cross-session identity and credential confusion flaw when configured with an authentication proxy. Under specific multi-tenant configurations where multiple distinct sessions authenticate with the same username, a global map caches credentials globally instead of isolating them inside the session context. This allows a concurrent attacker to hijack the active session backend of a victim using the same username.\n\n## TL;DR\nA global credential map in rclone's FTP auth-proxy driver allows an attacker sharing a generic username to hijack a victim's concurrent FTP session storage backend.\n\n## Technical Details\n\n- **CWE ID**: CWE-488 (Exposure of Data Element to Wrong Session)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.3 (High)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact**: Complete Cross-Session Information Disclosure and File Integrity Compromise\n\n## Affected Systems\n\n- rclone FTP server configurations utilizing the --auth-proxy option\n\n## Mitigation\n\n- Upgrade rclone to version 1.75.1 or newer to ensure session isolation.\n- Configure the authentication proxy script to guarantee unique usernames for all connecting clients.\n- Deactivate the --auth-proxy flag on exposed FTP server instances if unique usernames cannot be enforced.\n\n**Remediation Steps:**\n1. Verify the running version of rclone using the command: rclone version.\n2. Locate and download the appropriate patch release of rclone (v1.75.1+) from the official releases archive.\n3. Replace the old rclone binary on the target system and restart the serve ftp daemon processes.\n4. Verify that the driver-global cache has been eliminated by reviewing system configurations and checking the active session state logic.\n\n## References\n\n- [GitHub Security Advisory GHSA-c476-6w5q-jw77](https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77)\n- [rclone Fix Commit c6af0b57c2b4af848bc968c2b407354476184b99](https://github.com/rclone/rclone/commit/c6af0b57c2b4af848bc968c2b407354476184b99)\n- [rclone v1.75.1 Release Page](https://github.com/rclone/rclone/releases/tag/v1.75.1)\n- [NVD CVE-2026-88017 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-88017)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88017) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-11T11:09:30.334343Z"}, {"uuid": "4ddd6920-1c23-4c54-9377-8d63f669ec40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvahz4oxwm2p", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-11T11:36:20.939779Z"}, {"uuid": "cc0f9f07-ccb2-4620-b111-2e29d46c1169", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvasjldgwl24", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass\nCVSS 9.8 \u00b7 EPSS 0.5%\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-11T14:44:28.802569Z"}, {"uuid": "8711f2da-ebc6-4fd6-b474-67ad30f91e74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88017", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rclone-poc-pubblici-per-lo-sfruttamento-delle-cve-2026-88018-cve-2026-88044-cve-2026-88045-cve-2026-88016-e-cve-2026-88017", "content": "Disponibili Proof of Concept (PoC) per le CVE-2026-88018, CVE-2026-88044, CVE-2026-88045, CVE-2026-88016 e CVE-2026-88017 - gi\u00e0 sanate dal vendor - presenti in Rclone.", "creation_timestamp": "2026-09-11T16:00:46.902358Z"}, {"uuid": "2b2ff3ce-6cb1-48b9-9405-635390c96c96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88016", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rclone-poc-pubblici-per-lo-sfruttamento-delle-cve-2026-88018-cve-2026-88044-cve-2026-88045-cve-2026-88016-e-cve-2026-88017", "content": "Disponibili Proof of Concept (PoC) per le CVE-2026-88018, CVE-2026-88044, CVE-2026-88045, CVE-2026-88016 e CVE-2026-88017 - gi\u00e0 sanate dal vendor - presenti in Rclone.", "creation_timestamp": "2026-09-11T16:00:46.842012Z"}, {"uuid": "38541749-3229-4cd9-9786-90552fa55be5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rclone-poc-pubblici-per-lo-sfruttamento-delle-cve-2026-88018-cve-2026-88044-cve-2026-88045-cve-2026-88016-e-cve-2026-88017", "content": "Disponibili Proof of Concept (PoC) per le CVE-2026-88018, CVE-2026-88044, CVE-2026-88045, CVE-2026-88016 e CVE-2026-88017 - gi\u00e0 sanate dal vendor - presenti in Rclone.", "creation_timestamp": "2026-09-11T16:00:46.674719Z"}, {"uuid": "2e49dffc-3e9f-4ea2-b964-1e7736faa475", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvbaem7saz2u", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-11T18:52:14.321181Z"}, {"uuid": "d4f6e64f-baa5-488f-b4ab-cdad6b580431", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvbyx4w3bp2w", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T02:12:13.116188Z"}, {"uuid": "7332ab66-4bb7-411c-8f22-6b1b95b86b2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvcdahgke52u", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8 \u00b7 EPSS 0.5%\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T05:16:16.257154Z"}, {"uuid": "7f884830-ec0f-4091-b442-abc5a803ab92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvco2frk742t", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8 \u00b7 EPSS 0.5%\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T08:29:44.358920Z"}, {"uuid": "dfa647a2-5c9a-4768-aa2e-88d2e182d7b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvd43k2jpm2z", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T12:40:55.252203Z"}, {"uuid": "81f3f793-7fa2-4ab6-a4e1-600df088ee92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvdnneqqgg2u", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-12T17:55:06.632863Z"}, {"uuid": "2c4ab5a3-63a6-4e3f-9a7a-adb294750b4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mveupi343u2q", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-13T05:34:13.161997Z"}, {"uuid": "dbb62e1f-2da3-4776-ab0a-93df2036766d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvh6t67fz52p", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8 \u00b7 EPSS 0.5%\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-14T03:40:34.191196Z"}, {"uuid": "850e26fe-3631-4fcc-a5d4-4010129580b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mvigurqgsj2p", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-88018: rclone is a command-line program to sync files and directories to and from different cloud storage providers\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-88018\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-14T15:37:17.556779Z"}, {"uuid": "dc6c69a6-21e6-4c4b-b739-ca2609e2706e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88018", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvjqrkw3ue25", "content": "\ud83d\udccc CVE-2026-88018 - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configu... https://www.cyberhub.blog/cves/CVE-2026-88018", "creation_timestamp": "2026-09-15T04:07:07.798424Z"}, {"uuid": "aaac5738-b6cb-4174-8837-00f42403f1e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88010", "type": "published-proof-of-concept", "source": "https://github.com/traefik/traefik/security/advisories/GHSA-8fcf-v89g-xpg6", "content": "", "creation_timestamp": "2026-09-22T22:35:06.373066Z"}, {"uuid": "cd1bebd0-2f20-47d1-9f0b-60285ba5681b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88010", "type": "seen", "source": "https://gist.github.com/alon710/af64fb0e4974981b0997528347311521", "content": "# CVE-2026-88010: CVE-2026-88010: Unauthenticated Username-Enumeration Timing Oracle in Traefik BasicAuth Middleware\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88010\n\n## Summary\nAn unauthenticated timing oracle vulnerability exists in Traefik's BasicAuth middleware from version 3.6.11 up to (but not including) 3.7.13. By utilizing a request coalescing mechanism (singleflight.Group) that relies on server-side stored secret hashes for key generation, the software introduces a timing discrepancy. Concurrent requests targeting non-existent usernames generate identical singleflight keys and coalesce, resulting in accelerated response times. Conversely, requests targeting valid usernames produce distinct keys and execute independently, allowing remote attackers to systematically enumerate valid usernames.\n\n## TL;DR\nA design flaw in Traefik's BasicAuth singleflight deduplication mechanism allows unauthenticated attackers to discover valid usernames by measuring timing differences during coordinated concurrent requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-208\n- **Attack Vector**: Network\n- **CVSS Score**: 6.3\n- **EPSS Score**: Not Rated\n- **Impact**: Username Enumeration\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Traefik Proxy (versions v3.6.11 through v3.7.12)\n- **Traefik**: >= 3.6.11, < 3.7.13 (Fixed in: `3.7.13`)\n\n## Mitigation\n\n- Upgrade Traefik instances to version 3.7.13 or above\n- Transition from BasicAuth to Digest Authentication middleware\n- Implement strict concurrency and rate-limiting rules at the load balancer or WAF layer\n\n**Remediation Steps:**\n1. Identify all Traefik instances running versions between 3.6.11 and 3.7.12\n2. Update the deployment container image tag to 3.7.13 or above\n3. Apply the configuration change to the orchestrator (e.g., Kubernetes, Docker Compose)\n4. Monitor the proxy logs for any unexpected 401 Unauthorized spikes post-deployment\n\n## References\n\n- [Traefik Security Advisory](https://github.com/traefik/traefik/security/advisories/GHSA-8fcf-v89g-xpg6)\n- [Fix Commit](https://github.com/traefik/traefik/commit/ddc1bf4660b85fd61fafdd821eb8216fb1a0b130)\n- [Pull Request #13816](https://github.com/traefik/traefik/pull/13816)\n- [Traefik v3.7.13 Release Notes](https://github.com/traefik/traefik/releases/tag/v3.7.13)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-88010)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88010) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T23:31:56.672813Z"}]}