Vulnerability Description
rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Samba | Rsync | >= 3.1.0, < 3.5.0 |
Related Weaknesses (CWE)
References
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0ProductRelease Notes
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvrVendor Advisory
- https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-dRelease NotesThird Party Advisory
FAQ
What is CVE-2026-70463?
CVE-2026-70463 is a vulnerability with a CVSS score of 8.1 (HIGH). rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly han...
How severe is CVE-2026-70463?
CVE-2026-70463 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-70463?
Check the references section above for vendor advisories and patch information. Affected products include: Samba Rsync.