Description

rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T15:20:01.513Z",
  "pubdate": "2026-08-13T15:20:01.513Z",
  "executiveSummary": "Rsync versions 3.1.0 before 3.5.0 contain an authorization bypass vulnerability within the auth users directive parsing mechanism. The security flaw stems from improper tokenization logic when processing user and group access lists. Specifically, the parser relies exclusively on comma-only tokenization while failing to properly handle group entries designated by the @Group Name syntax that contain spaces. Consequently, spaces embedded within group names cause the parser to prematurely split the entry at the space boundary, resulting in the silent discarding of associated deny rules. This breakdown in access control logic presents severe risk implications, as authenticated users whose access should be explicitly restricted or denied by an @Group Name auth users configuration can successfully connect to restricted rsync modules. Successful exploitation requires the targeted rsync module to enforce access control lists containing group entries with spaces and assumes the attacker possesses valid authentication credentials to initiate a connection. The flaw undermines the foundational integrity of rsync module access controls, allowing unauthorized traversal or interaction with protected repository resources.",
  "technicalDetails": "The vulnerability resides in the auth users directive parsing component of rsync versions 3.1.0 through 3.4.x (prior to 3.5.0). The vulnerable component incorrectly tokenizes input strings by splitting user and group parameters based solely on comma delimiters without robustly accounting for multi-word group identifiers formatted as @Group Name. When an administrator defines an access restriction utilizing a group name containing a space character (e.g., @Group Name), the parser evaluates the space as a token boundary separator. This parsing anomaly prematurely terminates the evaluation of the entry, completely truncating and discarding the subsequent portion of the rule which establishes the intended deny behavior.\nThe exploitation mechanism relies on the divergence between expected access control evaluation and actual parser behavior. Step-by-step, the attack flow initiates when an authenticated user attempts to connect to a restricted rsync module. Normally, the authorization engine evaluates the connecting user against the configured auth users directive, matching explicit allow and deny patterns including group memberships prefixed with the @ symbol. Because the flawed parser silently drops the deny rule component associated with space-delimited group names due to improper tokenization, the access control evaluation engine fails to enforce the restriction. As a result, the authentication check bypasses the intended security constraint, permitting the authenticated user to establish a connection to the restricted module despite possessing a username or group membership that should have triggered a deny action. Network exposure involves services accessible over the rsync protocol, and the attack requires the adversary to be authenticated against the target service, while privilege requirements depend on valid credentials being supplied to pass the initial authentication phase before the authorization bypass takes effect."
}