CVE-2026-116193 in Rclone
Summary
by MITRE • 10/25/2026
Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified within Rclone versions prior to 1.75.2 represents a critical flaw in the implementation of the WebDAV server interface, specifically affecting the authentication mechanism during HTTP OPTIONS request handling. This issue stems from an incomplete enforcement of access control policies when processing method negotiation requests. In standard WebDAV operations, clients send OPTIONS requests to determine which methods are supported by a specific resource on the server. However, in this vulnerable configuration, the Rclone serve webdav component fails to require valid authentication credentials for these initial probe requests. This oversight allows unauthenticated actors to interact with the service without first establishing an authenticated session, effectively bypassing the intended security boundary that should protect sensitive data and directory structures from unauthorized access attempts.
The operational impact of this flaw is primarily centered on information disclosure through namespace enumeration. By sending OPTIONS requests to arbitrary paths within the WebDAV server, attackers can analyze the Allow header returned in the response. If a path exists as either a file or a collection (directory), the server typically returns specific HTTP methods such as GET, PUT, DELETE, MKCOL, or PROPFIND depending on the resource type and permissions. Conversely, if the path does not exist, the server may return an error status code like 404 Not Found or omit certain method allowances. By systematically probing different paths and comparing these Allow header values against expected patterns for existing versus non-existing resources, attackers can map out the directory structure of the remote storage backend connected to Rclone. This capability transforms a simple authentication bypass into a powerful reconnaissance tool that reveals sensitive file names, folder hierarchies, and potentially the underlying cloud provider or filesystem architecture being utilized by the victim organization.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to properly verify identity before granting access to functionality. Furthermore, it relates closely to CWE-209 Generation of Error Message Containing Sensitive Information and CWE-134 Use of Externally-Controlled Format String if error messages leak additional details, though the primary vector is enumeration via HTTP method analysis. In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1083 File and Directory Discovery, where attackers use legitimate system utilities or protocols like WebDAV to gather information about the target environment without triggering typical intrusion detection alerts associated with brute-force login attempts. The lack of authentication for OPTIONS requests also touches upon aspects of CWE-798 Use of Hard-coded Credentials if default configurations are exploited, but more accurately reflects a logic flaw in access control enforcement rather than credential weakness.
To mitigate this vulnerability, organizations running Rclone serve webdav must upgrade immediately to version 1.75.2 or later where the authentication check has been properly enforced for all HTTP methods including OPTIONS. Until an update is applied, administrators should implement network-level controls such as firewall rules or reverse proxy configurations that restrict access to the WebDAV port exclusively from trusted IP addresses. Additionally, deploying a web application firewall with specific rule sets capable of detecting and blocking unauthorized enumeration attempts can provide a layer of defense in depth. It is also advisable to review logging mechanisms to ensure that all OPTIONS requests are logged with source IP information, facilitating rapid detection of any ongoing reconnaissance activities targeting the service. Regular security audits of exposed services should include testing for authentication bypasses on non-standard HTTP methods to prevent similar enumeration-based attacks in other web-facing applications.