Incorrect authorization in Rsync - CVE-2026-70463
Published: August 13, 2026
Vulnerability identifier: #VU142277
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70463
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain unauthorized read or write access.
The vulnerability exists due to incorrect authorization in auth_server() `auth users` parsing when processing `rsyncd.conf` `auth users` values that begin with a comma. A remote user can authenticate as a member of a group that an administrator intended to deny or restrict to read-only to gain unauthorized read or write access.
The issue is silent because the configuration parses without error and a later first-match `:rw` entry can be applied instead of the intended group deny or read-only rule.
Affected software
Rsync
How to mitigate CVE-2026-70463
Install security update from vendor's website.
Rsync - update to 3.5.0