CVE-2026-116193

Name	CVE-2026-116193
Description	Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rclone (PTS)	bookworm	1.60.1+dfsg-2	fixed
	trixie	1.60.1+dfsg-4	fixed
	sid	1.75.2-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
rclone	source	bookworm	(not affected)
rclone	source	trixie	(not affected)
rclone	source	(unstable)	1.75.2-1

Notes

[trixie] - rclone <not-affected> (Vulnerable code not present)
[bookworm] - rclone <not-affected> (Vulnerable code not present)
https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj