High severity7.4NVD Advisory· Published Aug 13, 2026· Updated Nov 6, 2026
CVE-2026-70452
CVE-2026-70452
Description
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- osv-coords5 versionspkg:rpm/almalinux/rsyncpkg:rpm/almalinux/rsync-daemonpkg:rpm/almalinux/rsync-rrsyncpkg:rpm/opensuse/rsync&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/rsync&distro=openSUSE%20Tumbleweed
< 3.2.7-1.el9_8+ 4 more
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.4.1-160000.6.1
- (no CPE)range: < 3.5.1-1.1
Patches
Vulnerability mechanics
References
3- github.com/RsyncProject/rsync/security/advisories/GHSA-6692-28cx-wpqqnvdVendor Advisory
- www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolution-failurenvdThird Party Advisory
- github.com/RsyncProject/rsync/releases/tag/v3.5.0nvdRelease Notes
News mentions
1- Rsync: 25 Vulnerabilities Disclosed Together, Affecting Versions Before 3.5.0Vypr Intelligence · Aug 13, 2026