Live › vulnerability › CVE-2026-116193
Go to dashboardRclone's serve webdav mode, in versions from 1.64.0 before 1.75.2, lets unauthenticated clients skip login by sending OPTIONS requests. An attacker can use the differing Allow headers to tell which files and folders exist, which enumerates the server's file namespace.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Teams that run rclone's built-in WebDAV server () with authentication configured, on a version between 1.64.0 and 1.75.2. The exposure is the file namespace, not file contents, as far as the sources describe. Teams that only use rclone as a client, or do not run serve webdav, can skip it.
rclone serve webdavNo product ranges from the sources yet.
rclone version and confirm whether it reports a release from 1.64.0 up to but not including 1.75.2rclone serve webdav is running, for example with ps aux | grep rclone1.75.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.
This page as .md · .json · in your agent: get_signal("CVE-2026-116193")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.