{"id":"CVE-2026-116193","kind":"vulnerability","aliases":["CVE-2026-116193"],"related":[],"title":"Rclone: WebDAV server skips authentication on OPTIONS requests","description":"Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.","summary":"Rclone's serve webdav mode, in versions from 1.64.0 before 1.75.2, lets unauthenticated clients skip login by sending OPTIONS requests. An attacker can use the differing Allow headers to tell which files and folders exist, which enumerates the server's file namespace.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","rclone","self-hosted","webdav"],"not_affected_if":["client-only-use","no-webdav-server"],"how_to_check":"- Run `rclone version` and confirm whether it reports a release from 1.64.0 up to but not including 1.75.2\n- Check whether `rclone serve webdav` is running, for example with `ps aux | grep rclone`","fix":"- Upgrade rclone to `1.75.2` or later","status":"open","published_at":"2026-10-25T14:16:59+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:39+00:00","updated_at":"2026-10-25T14:42:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:42:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade rclone to `1.75.2` or later","reach":"network","title":"Rclone: WebDAV server skips authentication on OPTIONS requests","impact":"low","summary":"Rclone's serve webdav mode, in versions from 1.64.0 before 1.75.2, lets unauthenticated clients skip login by sending OPTIONS requests. An attacker can use the differing Allow headers to tell which files and folders exist, which enumerates the server's file namespace.","category":"package","nicknames":[],"who_cares":["rclone","self-hosted","webdav"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attackers map which files and folders exist on the server","analyst_note":"","how_to_check":"- Run `rclone version` and confirm whether it reports a release from 1.64.0 up to but not including 1.75.2\n- Check whether `rclone serve webdav` is running, for example with `ps aux | grep rclone`","needs_analyst":false,"not_affected_if":["no-webdav-server","client-only-use"],"who_is_affected":"Teams that run rclone's built-in WebDAV server (`rclone serve webdav`) with authentication configured, on a version between 1.64.0 and 1.75.2. The exposure is the file namespace, not file contents, as far as the sources describe. Teams that only use rclone as a client, or do not run serve webdav, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000597,"input_tokens":3338,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116193':11A,14A '-2026':10A,13A '1.64.0':29B,65C '1.75.2':31B,67C 'allow':47B,93C 'arbitrari':89C 'attack':42B,79C,86C 'authent':5A,70C,81C 'bypass':71C 'client':34B 'collect':101C 'compar':92C 'contain':68C 'cve':9A,12A 'determin':97C 'differ':46B 'enabl':103C 'enumer':57B,105C 'exist':55B,102C 'file':52B,61B,99C 'folder':54B 'header':48B,94C 'host':19B 'let':32B,77C 'login':36B 'mode':25B 'namespac':62B,104C 'option':7A,39B,84C 'packag':15B 'path':90C 'probe':88C 'rclone':1A,16B,21B,63C 'request':8A,40B,85C 'self':18B 'self-host':17B 'send':38B,83C 'serv':23B,74C 'server':3A,59B 'skip':4A,35B,80C 'tell':50B 'unauthent':33B,78C 'use':44B 'valu':95C 'version':27B 'vulner':72C 'webdav':2A,20B,24B,75C 'whether':98C","nicknames":[],"mitigations":[],"who_affected":"Teams that run rclone's built-in WebDAV server (`rclone serve webdav`) with authentication configured, on a version between 1.64.0 and 1.75.2. The exposure is the file namespace, not file contents, as far as the sources describe. Teams that only use rclone as a client, or do not run serve webdav, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116193","severity":null,"published_at":"2026-10-25T14:16:59+00:00","modified_at":"2026-10-25T14:16:59+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}