Access Control Bypass in rsync by rsync Project

CVE-2026-70452

What is CVE-2026-70452?

rsync versions prior to 3.5.0 are susceptible to an access control bypass vulnerability that allows attackers to evade hostname-based deny rules by inducing DNS resolution failures. When a DNS lookup connected to a deny rule fails, rsync's daemon bypasses the rule, enabling unauthorized users to bypass established IP access controls and potentially access restricted module file trees. This exposure underscores the necessity for prompt updates and a review of access control configurations to mitigate risks associated with this vulnerability.

References