External risk intelligence

Rsync Access Control Bypass via DNS Resolution Failure

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-70452

Rsync is frequently deployed as a network-accessible service for file synchronization. While often used in internal or controlled environments, it is also commonly exposed to the internet or wide area networks to facilitate data transfers, making the service reachable from the internet in some deployments.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in rsync, a widely used file synchronization tool. The issue stems from how rsync handles DNS resolution failures when evaluating access controls, potentially allowing unauthorized remote attackers to bypass security rules and access restricted file systems.

A security flaw lets attackers bypass access rules.
Important for any systems using rsync for data transfer.
Confirm rsync usage and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass access controls by manipulating DNS resolution to prevent rsync from properly evaluating hostname-based deny rules. By triggering a DNS lookup failure when a deny rule is checked, the rsync daemon may incorrectly proceed as if the rule doesn't exist, granting unauthorized access to restricted file trees. This could allow an attacker to access sensitive data or modify files they should not have access to.

Attacker exploits network exposure.
Trigger DNS resolution failures.
Leads to unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to bypass access controls when DNS resolution failures occur. This could grant unauthorized access to restricted module file trees by circumventing hosts' deny rules.

Module file trees.
DNS resolution failure during access control.
Unauthorized access to restricted files.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts rsync, a common tool for file synchronization. Ownership of this issue likely resides with the teams managing the infrastructure and applications that utilize rsync for data transfer, particularly those relying on its access control features. The initial step is to identify all instances of rsync, assess their exposure and criticality, and then assign responsibility for remediation to the appropriate system or application owner.

Identify and assess rsync instances.
Confirm external exposure and criticality.
Assign remediation to accountable owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is rsync?

Rsync is a widely used software utility for Unix-like systems that synchronizes files and directories between locations. It is frequently used for backups, mirroring, and transferring data between servers. By efficiently comparing source and destination files, it ensures only the necessary data changes are sent, making it a staple tool for system administrators managing data movement and consistency across distributed infrastructure.

How does CVE-2026-70452 work?

This vulnerability, classified as CWE-863 (Incorrect Authorization) and CWE-636 (Not Sending Sufficient Information), occurs when rsync evaluates hostname-based access control rules. If an attacker induces a DNS resolution failure during this check, the daemon skips the rule instead of defaulting to a deny state. This failure effectively removes the security barrier, granting unauthorized remote access to restricted file trees that were intended to be protected.

Do I need to do anything if I do not use hostname-based rules?

The vulnerability specifically exploits the logic used during hostname-based access control evaluation. If your rsync configuration relies strictly on IP-based access controls or does not utilize hostname-based deny rules, the specific mechanism for this bypass is not triggered. However, verify your daemon configuration files thoroughly to ensure no such rules exist, as even latent or forgotten settings could be leveraged if network conditions change.

Is my rsync instance at risk?

According to Halo Surface Signal, risk depends on your deployment. If your rsync service is reachable from the internet or a wide area network, it is a higher priority because remote attackers can attempt to trigger the required DNS resolution failures. Systems running in isolated, internal-only environments still face risk from malicious actors already inside your network perimeter, but external exposure significantly expands the pool of potential attackers.

What is the first step to address this rsync issue?

Start by auditing your infrastructure to create a complete inventory of all systems running rsync. Once identified, review the daemon configuration files to determine if hostname-based access rules are in use. If they are, prioritize these instances for updates. Finally, coordinate with the infrastructure or application owners responsible for those specific servers to plan the necessary software upgrades to version 3.5.0 or later.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.