Description

rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-13T15:19:58.740Z",
  "pubdate": "2026-08-13T15:19:58.740Z",
  "executiveSummary": "An access control bypass vulnerability exists in rsync versions 3.1.0 before 3.5.0 during the evaluation of hostname-based access control rules.\nThe vulnerability allows remote attackers to circumvent configured hosts deny rules by inducing DNS resolution failures.\nWhen a DNS lookup for a hostname-based deny rule fails, the rsync daemon incorrectly skips the rule instead of defaulting to a deny decision.\nThis enables remote attackers who can successfully trigger DNS resolution failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.\nThe risk implication is unauthorized read or write access to protected server resources depending on the underlying module configurations.\nExploitation requires the ability to manipulate or induce DNS resolution failures during the connection and access evaluation phase.",
  "technicalDetails": "The root cause of the vulnerability resides in the access control evaluation logic of the rsync daemon when processing hostname-based deny directives.\nThe affected component is responsible for parsing and enforcing host access control lists (ACLs) defined in daemon configuration files using hostname patterns.\nAffected versions include rsync 3.1.0 up to, but not including, 3.5.0.\nAuthentication requirements depend on the specific rsync module configuration, but the access control bypass occurs prior to or during the evaluation phase before full authentication is established.\nNo specific local privileges are required as the attack vector is network-exposed via the rsync network protocol.\nThe attack flow proceeds as follows: First, an attacker initiates a network connection to the vulnerable rsync daemon. Second, the daemon evaluates the connecting client against configured hosts deny rules that rely on hostname matching. Third, the attacker concurrently triggers a DNS resolution failure for the targeted hostnames used in the deny rules. Fourth, upon encountering the DNS lookup failure, the rsync daemon fails-open for that specific rule, skipping it rather than applying a restrictive deny decision. Finally, subsequent rules are evaluated, potentially allowing access if no other matching deny rules trigger, thereby granting the attacker unauthorized access to restricted module file trees."
}