CVE-2026-116193 Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

What is CVE-2026-116193?

CVE-2026-116193 is a medium-severity vulnerability in rclone, published on 25 Oct 2026.

Official description

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.

Weakness: CWE-200

Which versions are affected by CVE-2026-116193?

1 open source package ship an affected version, including rclone. It affects 1 product.

Products include Rclone Rclone.

How do I fix CVE-2026-116193?

Upgrade rclone to 1.75.2 or later.

Is CVE-2026-116193 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116193 exists.

Other vulnerabilities in rclone

• CVE-2026-88018 rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass Critical 9.8
• CVE-2026-49980 Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix Critical 9.8
• CVE-2026-41179 RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution Critical 9.2
• CVE-2026-41176 Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution Critical 9.2
• CVE-2026-59733 rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as BIT-rclone-2026-116193, GHSA-gj73-fh6v-92fj, GHSA-rw84-9qf5-6h67, UBUNTU-CVE-2026-116193.