Authorization Bypass in rsync Affects User Authentication

CVE-2026-70463

What is CVE-2026-70463?

In affected versions of rsync prior to 3.5.0, a vulnerability exists within the parsing of the 'auth users' directive, leading to an authorization bypass. The issue arises from how the parser tokenizes the user list. It incorrectly handles group names containing spaces, resulting in the group membership being improperly parsed. This flaw may allow authenticated users, who should be denied access based on their permissions, to connect to restricted modules since the associated deny rules are discarded silently. This could lead to unauthorized access to sensitive data and resources.

References