CVE-2026-70463

An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain unauthorized access to restricted modules.

This is an Important authorization bypass in rsync, affecting configurations that utilize the auth users directive with group names containing spaces. The flaw allows an authenticated, but unauthorized, user to access restricted rsync modules due to incorrect parsing of deny rules. This bypass occurs because the rsync parser fails to properly tokenize group names with embedded spaces, silently discarding intended access restrictions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent this authorization bypass, ensure that no group names containing spaces are used within the auth users directive in the rsyncd.conf configuration file. Review and update any existing configurations to remove spaces from group names in this directive. After making changes, restart the rsync service for the new configuration to take effect. For example, use systemctl restart rsyncd if managing the service with systemd. Note that restarting the service will temporarily interrupt active rsync operations.