p PatchFirst

CVE-2026-116193

CVE-2026-116193 · Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.

CVSS 6.9 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • rclone

    Versions
    • ≥ 1.64.0, < 1.75.2: Affected (semver)
    • 1.75.2: Not affected (semver)

    Update to 1.75.2

  • rclone Ubuntu:18.04:LTS

    Versions
    • 1.36-3
    • 1.36-3ubuntu0.1
    • 1.36-3ubuntu0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rclone Ubuntu:Pro:20.04:LTS

    Versions
    • 1.47.0+ex1-6
    • 1.47.0+ex1-7
    • 1.49.5-2
    • 1.49.5-3
    • 1.50.2-2
    • 1.50.2-2ubuntu0.1
    • 1.50.2-2ubuntu0.2
    • 1.50.2-2ubuntu0.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rclone Ubuntu:Pro:22.04:LTS

    Versions
    • 1.53.3-1
    • 1.53.3-2
    • 1.53.3-4
    • 1.53.3-4ubuntu1
    • 1.53.3-4ubuntu1.22.04.1
    • 1.53.3-4ubuntu1.22.04.2
    • 1.53.3-4ubuntu1.22.04.3
    • 1.53.3-4ubuntu1.22.04.3+esm1
    • 1.53.3-4ubuntu1.22.04.4
    • 1.53.3-4ubuntu1.22.04.4+esm1
    • 1.53.3-4ubuntu1.22.04.5
    • 1.53.3-4ubuntu1.22.04.5+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rclone Ubuntu:Pro:24.04:LTS

    Versions
    • 1.60.1+dfsg-2build1
    • 1.60.1+dfsg-3
    • 1.60.1+dfsg-3ubuntu0.24.04.1
    • 1.60.1+dfsg-3ubuntu0.24.04.2
    • 1.60.1+dfsg-3ubuntu0.24.04.3
    • 1.60.1+dfsg-3ubuntu0.24.04.4
    • 1.60.1+dfsg-3ubuntu0.24.04.4+esm1
    • 1.60.1+dfsg-3ubuntu0.24.04.5
    • 1.60.1+dfsg-3ubuntu0.24.04.5+esm1
    • 1.60.1+dfsg-3ubuntu0.24.04.6
    • 1.60.1+dfsg-3ubuntu0.24.04.6+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rclone Ubuntu:26.10

    Versions
    • 1.60.1+dfsg-4ubuntu3
    • 1.69.3+dfsg-3
    • 1.69.3+dfsg-3ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rclone Ubuntu:Pro:26.04:LTS

    Versions
    • 1.60.1+dfsg-4ubuntu2
    • 1.60.1+dfsg-4ubuntu3
    • 1.60.1+dfsg-4ubuntu3.1
    • 1.60.1+dfsg-4ubuntu3.1+esm1
    • 1.60.1+dfsg-4ubuntu3.2
    • 1.60.1+dfsg-4ubuntu3.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →