CVE-2026-70463 RsyncProject CVE debrief

Who should care

Administrators and users of rsync versions before 3.5.0 should be aware of this vulnerability and take necessary actions to update or mitigate the risk. This includes reviewing auth users directive configurations, verifying group memberships, and monitoring system logs for potential unauthorized access attempts. Security teams should prioritize patching or mitigating affected systems to prevent potential exploitation.

Technical summary

The auth users parser in rsync versions before 3.5.0 uses comma-only tokenization, which fails to correctly handle entries of the form @Group Name where the group name contains a space. This causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing. Affected systems should be updated to version 3.5.0 or later to mitigate this vulnerability.

Defensive priority

Authenticated users may bypass authorization due to a parsing issue with the auth users directive in rsync versions before 3.5.0.

Recommended defensive actions

• Review and update rsync installations to version 3.5.0 or later
• Verify auth users directive configurations for potential vulnerabilities
• Monitor rsync logs for unauthorized access attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-70463 record indicates an authorization bypass in rsync's auth users directive parsing. The issue arises from comma-only tokenization, which fails to handle group names with spaces correctly, potentially allowing unauthorized access to restricted modules. To verify, defenders should review auth users configurations, monitor rsync logs for anomalies, and ensure group names are properly formatted.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.