CVE-2026-70463: 
rsync vulnerability analysis and mitigation

CVE-2026-70463 is an authorization bypass vulnerability in rsync's auth users directive parsing, classified as Incorrect Authorization (CWE-863). It affects rsync versions 3.1.0 through 3.4.4 and was disclosed on August 13, 2026, with a fix released in version 3.5.0. The flaw allows an authenticated user who should be denied access — based on a group-based deny rule using a space-containing group name — to bypass that restriction and connect to a restricted rsync module. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Feedly).

The root cause lies in the auth_server() function, which tokenizes the auth users directive value using both commas and whitespace (strtok(users, " ,\t")), contrary to the documented behavior where a leading comma signals comma-only splitting. When an administrator configures a deny rule for a group with a space in its name — e.g., ,@Group Name:deny — the parser splits @Group Name at the space boundary, producing @Group (which matches only a group literally named "Group") and Name:deny (treated as a username). Because auth users is first-match, the intended deny rule is silently discarded and a subsequent permissive rule (e.g., :rw) matches instead. The fix in 3.5.0 replaces strtok() with conf_strtok(), which correctly honors the leading-comma convention for comma-only splitting (GitHub Advisory).

A low-privileged, authenticated attacker whose account or group membership should be denied access to a restricted rsync module can silently bypass the deny rule and gain unauthorized read and/or write access to that module. This results in high confidentiality and integrity impact — the attacker can exfiltrate sensitive files or tamper with synchronized data — with no availability impact. The failure is entirely silent: the configuration parses without error and appears correct to administrators, making detection difficult without explicit access log auditing (GitHub Advisory, Feedly).

As of the disclosure date, there is no confirmed public proof-of-concept exploit and no evidence of in-the-wild exploitation, per NVD SSVC assessment (Feedly). However, a GitHub repository (https://github.com/Fyyre/CVE-2026-70463) referencing the CVE appeared shortly after disclosure, suggesting early-stage PoC development activity. The EPSS score is approximately 0.34%, indicating a currently low but non-negligible probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires valid credentials to the rsync daemon but no elevated privileges, and the attack complexity is low.

1. Reconnaissance: Identify rsync daemon instances (port 873/TCP) using network scanners such as Nmap or Shodan. Confirm the target runs rsync 3.1.0–3.4.4 by querying the daemon banner.
2. Obtain valid credentials: Acquire any valid rsync username and password for the target daemon — even credentials for a user whose group membership is intended to be denied access.
3. Identify restricted modules: List available rsync modules using rsync rsync://target/ to enumerate modules and identify those with access restrictions.
4. Attempt access to restricted module: Connect to a module that should deny access based on a group rule with a space in the group name, e.g., rsync --password-file=pass.txt rsync://user@target/restricted_module/. Due to the parsing bug, the deny rule is silently discarded and access is granted.
5. Exfiltrate or modify data: Use standard rsync commands to download sensitive files (rsync -av rsync://user@target/restricted_module/ ./local/) or upload malicious content, depending on the module's effective permissions (GitHub Advisory).

• Network: Unexpected successful rsync connections (port 873/TCP) from users or IP addresses that should be denied access to specific modules; repeated connection attempts to restricted modules.
• Logs: rsync daemon logs (/var/log/rsyncd.log) showing successful authentication and module access for users belonging to groups that should be denied — particularly where the module's auth users directive contains group names with spaces.
• File System: Unexpected file additions, modifications, or deletions within rsync module paths; new files appearing in directories managed by restricted rsync modules.
• Configuration: Presence of auth users directives in rsyncd.conf using the ,@Group Name syntax (comma-prefixed, space-containing group names), which are silently mishandled by vulnerable versions (GitHub Advisory).

Upgrade rsync to version 3.5.0, which fixes the parsing bug by using conf_strtok() to correctly honor comma-only splitting when a leading comma is present (GitHub Release). SUSE has released security updates (SUSE-SU-2026:3634-1, SUSE-SU-2026:3657-1, SUSE-SU-2026:23253-1) and openSUSE has issued corresponding advisories; Fedora packages for versions 43 and 44 have also been updated (Feedly). As an immediate workaround, avoid using group names containing spaces in auth users directives — rename affected OS groups to remove spaces, or rewrite rules using individual usernames. Additionally, implement network-level access controls (firewall rules) to restrict rsync daemon access to trusted IP ranges until patching is complete.

The vulnerability was reported by researcher Andres Berbescu (credited as "4drez") and published by rsync maintainer Andrew Tridgell (tridge) as part of a major security release on August 13, 2026 (GitHub Advisory). VulnCheck published an advisory noting the authorization bypass mechanism. Linux distribution vendors including SUSE, openSUSE, and Fedora responded promptly with security update announcements. The FreeBSD VuXML database and AusCERT also issued corresponding bulletins, reflecting broad ecosystem awareness of the issue.