CVE-2026-70452

A flaw was found in rsync. This vulnerability allows a remote attacker to bypass hostname-based access control rules. By inducing DNS resolution failures, the rsync daemon incorrectly skips deny rules, granting unauthorized access to restricted module file trees.

This Important flaw in rsync allows remote attackers to bypass hostname-based access controls. By inducing DNS resolution failures, an attacker can circumvent hosts deny rules, potentially gaining unauthorized access to restricted rsync module file trees on systems configured with hostname-based access controls and exposed to untrusted networks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, configure rsync to use IP-based access controls instead of hostname-based rules in rsyncd.conf. Alternatively, restrict network access to the rsync daemon using firewall rules to allow connections only from trusted IP addresses or networks. This limits exposure by preventing untrusted remote attackers from reaching the service and attempting to induce DNS resolution failures. If changes are made to rsyncd.conf, the rsync daemon may need to be restarted or reloaded for the changes to take effect.