🔐 CVE Alert

CVE-2026-70463

HIGH 8.1

rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing

CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.

CWE CWE-863
Vendor rsyncproject
Product rsync
Published Aug 13, 2026
Stay Ahead of the Next One

Get instant alerts for rsyncproject rsync

Be the first to know when new high vulnerabilities affecting rsyncproject rsync are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Affected Versions

RsyncProject / rsync
3.1.0 ≤ 3.4.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr github.com: https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 vulncheck.com: https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing

Credits

4drez