CVE-2026-70452 RsyncProject CVE debrief

Who should care

System administrators and security teams responsible for rsync installations should assess exposure and prioritize remediation due to the critical nature of this vulnerability. This includes reviewing current deployments, understanding potential operational impacts, and implementing necessary controls to prevent unauthorized access.

Why it matters

CVE-2026-70452 is a critical access control bypass vulnerability in rsync that allows remote attackers to bypass module-level IP access controls and gain unauthorized access to restricted module file trees by inducing DNS resolution failures during hostname-based access control evaluation. System administrators and security teams should assess exposure and prioritize remediation.

• Remote attackers can bypass module-level IP access controls
• Unauthorized access to restricted module file trees is possible
• DNS resolution failures can be triggered to exploit the vulnerability
• Remediation priority is high due to the critical CVSS score

Technical summary

The rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.

Defensive priority

High

Recommended defensive actions

• Review and update rsync installations to version 3.5.0 or later
• Implement additional access controls to restrict module-level IP access
• Monitor rsync logs for suspicious activity
• Verify hostname-based access control configurations
• Conduct a thorough review of current rsync deployments to identify potential exposure
• Prioritize remediation based on the critical CVSS score and potential operational impacts
• Track exceptions and retest remediated assets to ensure successful mitigation

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. Additional details are available from source references, including GitHub release notes and Vulncheck advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.