Vulnerability in rclone

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund25 Oct 2026WID-SEC-2026-4156

  rclone: Multiple vulnerabilities Translated from German

  CVE-2026-116187CVE-2026-116191CVE-2026-116193+7 more CVEs

[ References ]References

• github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fjVendor Advisory
• www.vulncheck.com/advisories/rclone-1.64.0-before-1.75.2-serve-webdav-authentication-by…Third Party Advisory