CVE-2026-70463
Received Received - Intake

Authorization Bypass in rsync via Malformed Group Name

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-70463
EUVD
EUVD-2026-58041

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in rsync versions 3.1.0 through 3.4.4. It occurs in the parsing of the 'auth users' directive where entries with spaces, like '@Group Name', are incorrectly split at the space. This causes deny rules for the group to be discarded, allowing authenticated users who should be denied access to bypass restrictions and connect to protected modules.

Detection Guidance

Check rsync version with 'rsync --version' to confirm if your version is between 3.1.0 and 3.4.4. Review rsyncd.conf for auth users directives containing entries with spaces like '@Group Name' which may indicate misconfiguration. Use 'grep -r "auth users" /etc/rsyncd.conf' to locate relevant configurations.

Impact Analysis

An attacker could exploit this by crafting a username or group membership that includes a space, bypassing intended authorization controls. This could allow unauthorized access to restricted rsync modules, potentially leading to data leaks or unauthorized modifications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected rsync versions may fail to meet access control and data protection standards, risking non-compliance and potential legal consequences.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. If upgrading is not possible, review and correct all auth users directives in rsyncd.conf to avoid spaces in group names or use alternative authorization methods. Restart rsync service after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70463. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart