Vulnerability · Published Oct 25, 2026 · Assigned by VulnCheck

CVE-2026-116193Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

Medium 5.3

In plain English

A medium-severity information exposure in rclone from rclone. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 83.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	rclone	1.75.2-r0	ALPINE-CVE-2026-116193
Ubuntu:26.10	rclone	no fix listed	UBUNTU-CVE-2026-116193

Affected products (as reported)

Vendor	Product	Versions
rclone	rclone	1.64.0 – before 1.75.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-gj73-fh6v-92fj) vendor-advisory
VulnCheck Advisory: Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests third-party-advisory