CVE-2026-70463

Executive Summary

CVE-2026-70463 is a high-severity authorization bypass vulnerability affecting rsync versions 3.1.0 through 3.4.x. The flaw resides in the auth users directive parser that handles group-based access control entries of the form @Group Name — when the group name contains a space, the parser splits the entry at the space boundary and silently discards the associated deny rule, allowing unauthorized users to connect to restricted modules. With a CVSS score of 8.1, this vulnerability enables authenticated attackers to achieve high confidentiality and integrity impact against systems running vulnerable rsync daemons exposing restricted modules over the network.

Technical Analysis

The vulnerability is rooted in the tokenization logic of rsync's auth users directive parser. The parser is designed to process a comma-separated list of authorized users and groups, where entries prefixed with "@" denote group-based access control. The intended syntax allows entries of the form @Group Name, where "Group Name" refers to a group whose identifier contains a space.

The core flaw: the auth users parser uses comma-only tokenization when splitting the user list. When processing an entry containing a space within the group name, the parser fails to recognize the space as part of the group identifier and instead splits the entry at the space boundary. This split operation causes the trailing portion of the entry (which would carry the deny rule or access restriction semantics) to be discarded entirely.

The functional consequence is that a deny rule explicitly associated with a group via an @Group Name directive is silently dropped during the parsing phase. The system never evaluates the deny rule, meaning the access control check that would have blocked the user is never performed.

From a vulnerability class perspective, this is an authorization bypass (CWE-863: Incorrect Authorization). The parser's failure to correctly handle whitespace in group names results in access control rules being malformed or omitted, leading to incorrect authorization decisions. The vulnerability is exploitable by any authenticated user whose username or group membership would have been denied by the intended configuration.

The attack surface is the rsync daemon running in server mode with restricted modules configured using the auth users directive containing @Group Name entries where the group name includes spaces. The flaw is in the configuration parsing layer, not in the network protocol itself, making it deterministic and reliable for an attacker who can authenticate with valid credentials to the rsync service.

Exploitation Scenarios

Reconnaissance and Target Identification (Stage 1): An attacker begins by scanning for systems exposing rsync on the default TCP port 873 or in an unprivileged range. Using tools like Shodan, masscan, or nmap, the attacker identifies rsync endpoints and queries available modules using the rsync protocol banner (@RSYNCD:) or by attempting module listing. The attacker looks for systems where module restrictions appear to be configured, particularly those that might use group-based controls.

Triggering the Flaw (Stage 2): The attacker authenticates to the rsync service with valid credentials — the vulnerability requires an authenticated session (CVSS attack complexity is Low, requiring Low privileges). During authentication, the attacker's username is checked against the configured auth users list. If the rsync daemon's configuration contains an auth users entry of the form @Some Group (with a space in the group name), the parser splits this entry at the space, discarding the deny rule. The attacker receives a successful authentication response, and access control checks that should reject them are never evaluated.

Payload and Execution (Stage 3): At the vulnerability-class level, this is not a memory corruption or code injection flaw — it is a logic/authorization bypass. The attacker exploits the parsing flaw to gain access to a restricted rsync module. Access can be exercised using standard rsync client operations:

• Listing module contents via rsync --list-only
• Downloading files to exfiltrate sensitive data (confidentiality impact)
• Uploading files to the restricted module, potentially overwriting legitimate data or planting malicious content (integrity impact)

Post-Exploitation Impact (Stage 4): After breaching the access control, the attacker can read restricted files, which may include configuration files, credentials, sensitive documents, or backup data. The attacker can also write files to the module, potentially modifying system configuration, tampering with application data, or planting malware for lateral movement. The CVSS vector indicates High impact on both confidentiality and integrity, with no availability impact.

Note: No public PoC exists for this vulnerability; the attack chain is inferred from the vulnerability class and the specific parsing flaw described in the NVD entry.

Impact Assessment

The business impact is significant for organizations that rely on rsync for secure file transfer between trusted systems. Environments where rsync daemons are exposed to networks with partial trust boundaries are most at risk. The vulnerability undermines the access control model entirely for affected configurations — a deny rule is not merely bypassed, it is completely discarded by the parser. This means the security posturing of the system is fundamentally broken for those specific configurations, not just weakened.

Blast radius considerations: because rsync is commonly used in backup systems, staging servers, and content distribution (mirroring), a successful exploit could expose backup datasets containing sensitive information or allow tampering with published content. The requirement for valid credentials partially limits the exposure, but low-privilege accounts that would normally be denied access to specific modules can now access them.

Detection Guidance

The following detection content is provided to help security teams identify exploitation attempts of CVE-2026-70463 in their environments.

Sigma Rule

title: Suspicious rsync Auth Users Group Parsing Anomaly
id: 6a2f5c4e-7b8d-4e9a-9f6c-2d1e3f4a5b6c
status: experimental
description: Detects rsync daemon sessions where a user with group membership attempts to access a module configured with group-based auth directives containing spaces in group names, indicating potential CVE-2026-70463 exploitation.
logsource:
  category: application
  product: rsync
detection:
  selection_module_access:
    event.type: "session start"
    rsync.user: "*"
    rsync.module: "*"
  selection_restricted_module:
    rsync.module:
      - "*"
    rsync.auth_method: "group"
  filter_known_good:
    rsync.groups_allowed: "NULL"
  condition: selection_module_access and selection_restricted_module and not filter_known_good
level: high
falsepositives:
  - Legitimate access by users explicitly listed in auth users directive (non-group entries)
  - rsync configurations where group-based entries do not contain spaces in group names
tags:
  - attack.t1190
  - cve.2026-70463
  - cwe.863

YARA Rule

rule CVE_2026_70463_rsync_auth_users_parser {
    meta:
        author = "Valters IT Security Research"
        description = "Detects rsync configuration files containing group-based auth users entries with spaces in group names, indicating susceptibility to CVE-2026-70463"
        cve = "CVE-2026-70463"
        date = "2026-01-01"
    strings:
        $auth_directive = "auth users"
        $group_entry = /(@[A-Za-z0-9_]+ [A-Za-z0-9 ]+)/
        $auth_directive_extended = "auth users = " ascii wide
    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or true) and
        any of them
}

Suricata IDS Rule

alert tcp any any -> any 873 (msg:"CVE-2026-70463 Potential rsync Auth Users Group Bypass"; flow:established,to_server; content:"@RSYNCD:"; nocase; content:"auth users"; nocase; distance:0; content:"@"; nocase; content:" "; within:256; pcre:"/@[A-Za-z0-9_][A-Za-z0-9_ ]+\s[A-Za-z0-9 ]+/i"; classtype:attempted-admin; sid:2026704630; rev:1; reference:cve,2026-70463; metadata:attack_target_file_server;)

Elastic Detection

configuration where event.dataset == "rsync.daemon" and process.args : "*auth users*" and process.args : "*@* *" and process.args : "*@* " and process.args : "* "*"*"

Splunk SPL Query

index=main sourcetype="rsync:daemon" 
| where match(command, "_(?i)auth users_") AND match(command, "_@.* .*_") 
| table _time, host, user, module, src_ip, command 
| search user=* 
| eval high_risk_activity = case(
    match(module, "_(?i)restricted_") OR match(module, "_(?i)private_") OR match(module, "_(?i)confidential_"), "yes",
    true(), "no"
  ) 
| where high_risk_activity = "yes" 
| stats count by host, user, src_ip, module

Wazuh OSSEC Rule

<group name="rsync,">
  <rule id="975694" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">^rsync</field>
    <regex>auth users|@.* .*</regex>
    <description>CVE-2026-70463: Potential rsync auth users group bypass exploitation - %(user) attempting access to %(module)</description>
    <group>authentication_failed,access_control,rsync,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

Currently, no tracked patch evidence exists for CVE-2026-70463. The vulnerable window spans rsync 3.1.0 through 3.4.x. Based on the version range given, a fix is expected to be released in rsync 3.5.0, but no confirmatory advisory, commit reference, or release notes from any tracked source are available at this time.

1. Immediate Mitigations

• If rsync 3.5.0 is not yet available, do not rely on group-based auth users entries containing spaces. Reconfigure rsync daemons to use individual user lists in the auth users directive instead of group entries where the group name contains a space.
• Validate all existing auth users configurations. Manually review every rsync module configuration. Identify any auth users entries matching the pattern @Group Name (group name with a space). These configurations are inherently unsafe and should be rewritten.
• Segment network exposure. If rsync daemons are exposed to any network segment beyond a strictly controlled management VLAN, limit access using firewall rules or TCP wrappers to known authorized source IP ranges.
• Enforce additional authentication layers. Run rsync inside SSH tunnels (using the -e ssh option) to require SSH authentication, which is not affected by this parsing flaw.
• Disable write access where not strictly required. Set the module to read only = yes to reduce integrity impact.

2. Patch/Upgrade Steps

• Monitor rsync official channels (rsync.samba.org, rsync GitHub repository, associated mailing lists) for the release of rsync 3.5.0.
• When 3.5.0 is released, test the upgrade in a staging environment, particularly for compatibility with existing module configurations and auth users directives.
• Roll out the upgrade across production systems, prioritizing internet-facing rsync daemons and those processing sensitive data.
• After upgrade, run a configuration validation to ensure that deny rules for @Group Name entries are now properly enforced.

3. Long-Term Hardening

• Remove the use of group names containing spaces in rsync auth users directives permanently, regardless of the patch status, as this reliance on a space-containing identifier is fragile and prone to similar parser issues.
• Implement centralized access control: consider replacing daemon-managed rsync authentication with SSH-based authentication, which provides stronger, better-audited access control.
• Monitor rsync daemon logs continuously for failed authentication attempts followed by unexpected successful module access, which may indicate attempts to exploit this or similar parsing vulnerabilities.
• Establish a configuration validation pipeline that automatically tests auth users directives for known parser-ambiguous patterns during CI/CD of infrastructure configuration.
• Track CVSS and EPSS updates for CVE-2026-70463; FIRST.org has not yet scored EPSS, but revisit once a score becomes available to prioritize remediation.

References

1. NVD Entry for CVE-2026-70463 — https://nvd.nist.gov/vuln/detail/CVE-2026-70463
2. rsync Project Official Site — https://rsync.samba.org/ — monitor for 3.5.0 release notes and project advisories
3. CWE-863 — Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html — vulnerability class reference
4. MITRE ATT&CK — T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/ — relevant tactic and technique mapping

Campaign and Exploit Intelligence: No known threat actor campaigns have been associated with CVE-2026-70463 at the time of writing. There is no evidence of exploitation in the wild, no public exploit code, and no Nuclei templates. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, given rsync's widespread use in backup and file-synchronization infrastructure, and the low complexity of the exploitation path (requiring only valid credentials), this CVE should be treated as a high-priority monitoring target for security teams until a patch is confirmed and deployed.