{"id":"CVE-2026-116193","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-116193","generatedAt":"2026-10-28T04:49:35.207Z","title":"Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests.","description":"Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.","published":"2026-10-25T14:17:00.000Z","lastModified":"2026-10-27T14:10:23.000Z","status":"Analyzed","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":6.9,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-200"],"affected":["rclone/rclone"],"epss":{"score":0.00262,"percentile":0.17918,"date":"2026-10-27","history":[{"date":"2026-10-26","score":0.00262,"percentile":0.17855}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-25T14:17:00.000Z","detail":{"score":"6.9","severity":"MEDIUM","publishedAt":"2026-10-25T14:16:59.703Z"},"summary":"New CVE, medium severity (CVSS 6.9)."}],"references":[{"url":"https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj","tags":["Vendor Advisory"],"source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/rclone-1.64.0-before-1.75.2-serve-webdav-authentication-bypass-via-options-requests","tags":["Third Party Advisory"],"source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-116193","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}