Authentication Bypass in Rclone WebDAV by Rclone, Inc.

CVE-2026-116193

What is CVE-2026-116193?

An authentication bypass vulnerability exists in Rclone's WebDAV serve feature, allowing unauthenticated attackers to exploit OPTIONS requests. By sending these requests, attackers can bypass authentication, allowing them to probe arbitrary paths. They can then access the Allow header values to identify whether certain files or collections exist, leading to potential namespace enumeration and exposing sensitive data.

References