CVE-2026-70452
High
Description
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.
SeverityHigh
CVSS7.4
Exploit probability—
ProductRsync
PublishedAug 13, 2026
First seenAug 13, 2026
Weakness typeCWE-863Incorrect authorizationCWE-636CWE-636
How to fix
Update
- samba rsync3.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| RsyncProject rsync | 3.1.0 ≤ v ≤ 3.4.4 | — |
| samba rsync | 3.1.0 ≤ v < 3.5.0 | 3.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.