rsync 3.1.0-3.4.x Auth Users Bypass via @Group Name Parsing
CVE-2026-70463 Published on August 13, 2026
rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.
Vulnerability Analysis
CVE-2026-70463 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-70463 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-70463
Want to know whenever a new CVE is published for Samba Rsync? stack.watch will email you.
Affected Versions
RsyncProject rsync:- Version 3.1.0, <= 3.4.4 is affected.
- Version 3.5.0 is unaffected.