UBUNTU-CVE-2026-116193: Security vulnerability

Published Oct 25, 2026

Updated

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.

Event History

Oct 25, 2026

CVE Published

via OSV·02:16 PM

Data Sourced

via OSV·02:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Rclone serve webdav in versions from 1.64.0 before 1.75.2 are affected. The exposed interface is the WebDAV service.

What does an attacker need to exploit it?

An unauthenticated attacker needs to be able to send OPTIONS requests to the Rclone WebDAV service. They can compare Allow header values for arbitrary paths to infer whether files or collections exist.

Does exploitation allow attackers to read file contents?

The provided information describes namespace enumeration only: attackers can determine whether files or collections exist. It does not state that this issue grants access to file contents.

What version addresses the issue?

Rclone 1.75.2 addresses the affected version range described in the advisory.

UBUNTU-CVE-2026-116193: Security vulnerability

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Does exploitation allow attackers to read file contents?

What version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Does exploitation allow attackers to read file contents?

What version addresses the issue?