Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck
CVE-2026-70452rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
High 7.4
In plain English
A high-severity incorrect authorization in rsync from RsyncProject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | rsync | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:8 | rsync | 3.1.3-28.el8_10 | ALSA-2026:74095 |
| AlmaLinux:9 | rsync | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| AlmaLinux:10 | rsync-daemon | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:8 | rsync-daemon | 3.1.3-28.el8_10 | ALSA-2026:74095 |
| AlmaLinux:9 | rsync-daemon | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| AlmaLinux:10 | rsync-rrsync | 3.5.0-3.el10_2 | ALSA-2026:67463 |
| AlmaLinux:9 | rsync-rrsync | 3.2.7-1.el9_8 | ALSA-2026:67462 |
| Alpine:v3.21 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-70452 |
| Alpine:v3.22 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-70452 |
| Alpine:v3.23 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-70452 |
| Alpine:v3.24 | rsync | 3.5.0-r0 | ALPINE-CVE-2026-70452 |
| Debian:12 | rsync | no fix listed | DEBIAN-CVE-2026-70452 |
| Debian:13 | rsync | 3.5.0+ds1-0+deb13u1 | DEBIAN-CVE-2026-70452 |
| Debian:14 | rsync | 3.5.0+ds1-1 | DEBIAN-CVE-2026-70452 |
| Rocky Linux:10 | rsync | 0:3.5.0-3.el10_2 | RLSA-2026:67463 |
| Rocky Linux:8 | rsync | 0:3.1.3-28.el8_10 | RLSA-2026:74095 |
| Rocky Linux:9 | rsync | 0:3.2.7-1.el9_8 | RLSA-2026:67462 |
| Ubuntu:22.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-70452 |
| Ubuntu:24.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-70452 |
| Ubuntu:26.04:LTS | rsync | no fix listed | UBUNTU-CVE-2026-70452 |
| Ubuntu:26.10 | rsync | no fix listed | UBUNTU-CVE-2026-70452 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RsyncProject | rsync | 3.1.0 – through 3.4.4 |
Weakness: CWE-863, CWE-636 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- GitHub Security Advisory (GHSA-6692-28cx-wpqq) vendor-advisory
- rsync 3.5.0 Release Notes release-notes
- https://www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolution-failure third-party-advisory