An unauthenticated remote code execution and data access vulnerability in rclone versions prior to 1.75.1 poses a critical risk to exposed S3 storage configurations.

The flaw stems from improper authentication handling in the S3 serve module when using an auth proxy without a configured auth key. An unauthenticated attacker can register an arbitrary access key with an empty secret, allowing them to bypass identity verification and access backend storage resources.

This vulnerability carries a CVSS score of 9.8, indicating a critical risk of full system compromise. Successful exploitation allows unauthorized parties to read, modify, or delete sensitive data stored in backend cloud providers, potentially leading to severe data breaches, loss of intellectual property, and significant regulatory non-compliance.

Immediate Action: Update rclone to version 1.75.1 or later immediately to apply the necessary authentication logic fixes.

Proactive Monitoring: Review access logs for any S3 requests originating from unknown or unauthorized IP addresses that utilize anomalous access keys.

Compensating Controls: If an immediate update is not feasible, disable the rclone serve s3 functionality or restrict access to the service via network-level controls, such as IP allowlisting or a Web Application Firewall, to block untrusted external requests.

Public Exploit Available: Unknown

Given the critical CVSS severity and the ease of exploitation, organizations utilizing rclone in a server capacity must prioritize this update. Administrators should verify their current deployment versions and apply the patch to version 1.75.1 as part of their next maintenance window to prevent potential unauthorized access to cloud storage backends.