Description
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.
Published: 2026-08-13
Score: 9.1 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

rsync versions 3.1.0 through 3.4.x contain a flaw that allows an attacker to bypass hostname‑based access control rules that are configured to deny certain hosts. When a DNS lookup for a hostname in a deny rule fails, the daemon simply skips that rule instead of applying the deny, granting unauthorized users access to protected file trees. The weakness is a failure‑to‑deny logic error and is classified as CWE-636 and CWE-863.

Affected Systems

The vulnerability affects the RsyncProject rsync software in all releases from 3.1.0 up to and including 3.4.x. Systems running these versions with hostname‑based deny rules are susceptible; upgrades to 3.5.0 or newer contain the correct deny behaviour.

Risk and Exploitability

The CVSS score of 9.1 indicates high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring an attacker to trigger a DNS resolution failure for a deny rule hostname. When the failure occurs the daemon does not deny, exposing the protected module to unauthenticated access.

Generated by OpenCVE AI on August 13, 2026 at 17:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply rsync 3.5.0 or newer to address the denial bypass bug
  • Configure the system to prevent or log DNS failures for deny rule hostnames, ensuring a fail‑safe deny is enforced
  • Audit network traffic and system logs for unexpected DNS errors that could signal an attempted bypass

Generated by OpenCVE AI on August 13, 2026 at 17:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Description rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.
Title rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
Weaknesses CWE-636
CWE-863
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 9.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-13T14:46:50.541Z

Reserved: 2026-08-04T14:52:23.814Z

Link: CVE-2026-70452

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-13T15:19:58.740

Modified: 2026-08-13T15:19:58.740

Link: CVE-2026-70452

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T17:15:05Z

Weaknesses
  • CWE-636

    Not Failing Securely ('Failing Open')

  • CWE-863

    Incorrect Authorization