CVE-2026-70452

CVE-2026-70452 exposes a fail-open design flaw in rsync's hostname-based access control that should change how you think about rsync deployments immediately. When rsyncd.conf contains hostname deny rules, a DNS lookup failure causes rsync to skip the rule entirely rather than deny by default — the attacker lands inside your module with full filesystem access, not in a sandboxed error state. This isn't a subtle implementation bug; it's an architectural choice where DNS resolution failure maps to 'permit' rather than 'secure default.' The CVSS 7.4 rating obscures more than it clarifies. Exploiting this requires either MITM positioning on DNS queries or exploitation of DNS infrastructure — non-trivial prerequisites that the EPSS score of 0.00462 reflects more accurately. The real risk isn't the bypass itself; it's what lives behind the rsync module. Backup archives, release artifacts, credential-containing config trees — exactly the high-value data that motivated access controls in the first place. Three actions define your response. First, audit rsyncd.conf for any `hosts deny` or `hosts allow` rules using hostnames — these are now untrusted and should be converted to IP-based rules or removed. Second, examine your DNS infrastructure for the rsync server: if an attacker can manipulate or intercept those lookups, they own the access control. Third, and most critically, check rsync's logging behavior when hostname resolution fails. If the daemon logs nothing when a rule is skipped due to lookup failure, you have an observability gap — bypasses may have occurred without generating any security event. Enable debug logging or consider whether hostname-based controls were ever trustworthy given that DNS is a mutable, attackable resolution layer. This vulnerability belongs to a recurring class of fail-open-on-resolution-error bugs with precedent in SSH's UseDNS history. The pattern keeps reproducing because security knowledge is siloed by product rather than by flaw class. Your remediation should extend beyond this single CVE: audit other network services for the same DNS-dependent access control pattern. The fix patches rsync; the systemic exposure is what warrants sustained attention.

Reviewed through automated stages and approved by a human before publication.