rsync 3.1.0-3.4.x DNS Bypass: Host Blocking Skipped on Lookup Failure
CVE-2026-70452 Published on August 13, 2026
rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.
Vulnerability Analysis
CVE-2026-70452 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-70452 has been classified to as an AuthZ vulnerability or weakness.
What is a Failing Open Vulnerability?
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions. By entering a less secure state, the product inherits the weaknesses associated with that state, making it easier to compromise. At the least, it causes administrators to have a false sense of security. This weakness typically occurs as a result of wanting to "fail functional" to minimize administration and support costs, instead of "failing safe."
CVE-2026-70452 has been classified to as a Failing Open vulnerability or weakness.
Products Associated with CVE-2026-70452
Want to know whenever a new CVE is published for Samba Rsync? stack.watch will email you.
Affected Versions
RsyncProject rsync:- Version 3.1.0, <= 3.4.4 is affected.
- Version 3.5.0 is unaffected.