CVE-2026-70452
Received Received - Intake

rsync Access Control Bypass via DNS Resolution Failure

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-70452
EUVD
EUVD-2026-58052

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-636 When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-70452 is an access control bypass in rsync versions 3.1.0 through 3.4.4. It allows remote attackers to bypass hostname-based deny rules by causing DNS resolution failures. When a DNS lookup for a deny rule fails, the rsync daemon skips the rule instead of denying access, enabling unauthorized access to restricted file trees.

Detection Guidance

To detect this vulnerability, check if your rsync version is between 3.1.0 and 3.4.4. Run `rsync --version` to verify. Inspect rsync daemon configuration files for `hosts deny` rules and test DNS resolution for denied hostnames. Monitor logs for failed DNS lookups during access attempts.

Impact Analysis

If you use rsync with hostname-based access controls, attackers could exploit this flaw to bypass restrictions and access sensitive data. This is especially risky if your rsync daemon is exposed to untrusted networks or if DNS resolution is unreliable.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected rsync versions may fail compliance audits if they cannot demonstrate proper access controls.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. If upgrading is not possible, disable hostname-based access controls by removing `hosts allow` and `hosts deny` rules or ensure DNS resolution is reliable. Restrict network access to the rsync daemon via firewalls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70452. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart