---
id: CVE-2026-116193
title: >-
  Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS
  Requests
summary: >-
  Rclone from 1.64.0 before 1.75.2 contains an authentication bypass
  vulnerability in serve webdav that lets unauthenticated attackers skip
  authentication by sending OPTIONS requests. Attackers can probe arbitrary
  paths and compare Allow h…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: rclone
product: rclone
affected:
  - rclone >= 1.64.0 < 1.75.2
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T13:20:27.801Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116193'
references:
  - url: 'https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj'
    label: GitHub Security Advisory (GHSA-gj73-fh6v-92fj)
  - url: >-
      https://www.vulncheck.com/advisories/rclone-1.64.0-before-1.75.2-serve-webdav-authentication-bypass-via-options-requests
    label: >-
      VulnCheck Advisory: Rclone 1.64.0 before 1.75.2 serve webdav
      Authentication Bypass via OPTIONS Requests
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.944Z'
---

## Overview

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.

## Affected

- `rclone >= 1.64.0 < 1.75.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.