CVE-2026-116193: Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

Q: Which deployments are exposed to this issue?

Rclone deployments running versions 1.64.0 through versions before 1.75.2 are affected when using the serve webdav functionality. The issue is reachable over the network through OPTIONS requests.

Q: What can an unauthenticated attacker learn?

An attacker can send OPTIONS requests to arbitrary paths and compare the returned Allow header values. This can reveal whether targeted files or collections exist and enable namespace enumeration.

Q: Does exploitation require credentials or user interaction?

No. The reported vector is network-accessible, requires no privileges, has low attack complexity, and does not require user interaction.

Q: What version resolves the issue?

Upgrade Rclone serve webdav deployments to version 1.75.2 or later. The affected range is 1.64.0 before 1.75.2.

Published Oct 25, 2026

Updated

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.

Affected Software

1 affected component

Rclone Rclone>=1.64.0<1.75.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rclone to a version that resolves this vulnerability.
Fixed in 1.75.2

Event History

Oct 25, 2026

CVE Published

via MITRE·01:20 PM

Data Sourced

via MITRE·01:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Rclone deployments running versions 1.64.0 through versions before 1.75.2 are affected when using the serve webdav functionality. The issue is reachable over the network through OPTIONS requests.

What can an unauthenticated attacker learn?

An attacker can send OPTIONS requests to arbitrary paths and compare the returned Allow header values. This can reveal whether targeted files or collections exist and enable namespace enumeration.

Does exploitation require credentials or user interaction?

No. The reported vector is network-accessible, requires no privileges, has low attack complexity, and does not require user interaction.

What version resolves the issue?

Upgrade Rclone serve webdav deployments to version 1.75.2 or later. The affected range is 1.64.0 before 1.75.2.

CVE-2026-116193: Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What can an unauthenticated attacker learn?

Does exploitation require credentials or user interaction?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What can an unauthenticated attacker learn?

Does exploitation require credentials or user interaction?

What version resolves the issue?