CVE-2026-70463 rsync 3.1.0 < 3.5.0 Authorization Bypass via auth users Directive Parsing
An authenticated user can bypass access restrictions on rsync modules if the auth users directive contains group names with spaces, allowing unauthorized access to restricted data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-70463?
CVE-2026-70463 is a high-severity authentication bypass vulnerability in RsyncProject rsync, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.
Weakness: CWE-863
Which versions are affected by CVE-2026-70463?
It affects 1 product.
Products include Samba Rsync.
How do I fix CVE-2026-70463?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-70463 being exploited?
There is no known exploitation of CVE-2026-70463 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in RsyncProject rsync
- CVE-2017-15994 Security feature bypass in n/a
- CVE-2026-53791 rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
- CVE-2026-70461 rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
- CVE-2026-70455 rsync 3.4.2 < 3.5.0 DoS via --zt Zstandard Compression Thread Exhaustion
- CVE-2026-53803 rsync < 3.5.0 Symlink Following Arbitrary File Overwrite
Sources
Also known as ALPINE-CVE-2026-70463, AZL-95801, BELL-CVE-2026-70463, DEBIAN-CVE-2026-70463, ECHO-f2d9-9a60-877f, GHSA-pfj8-79vq-xgvr and 2 more.