VulnSocial

CVE-2026-70452Disclosure(samba / rsync)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees.

samba CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-636CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • rsync

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
samba
Products
rsync

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-23: 1Technical Details · 2026-09-23: 109-23
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • Leonid Bugaev@buger
    Disclosure

    One of the rsync requirements looked almost embarrassingly simple. A host matching hosts deny must not be admitted. The check failed. When a hostname in a deny rule could not be resolved, rsync skipped the rule. Under that config it failed open. That became CVE-2026-70452, rated HIGH.

    Post summary

    The text discloses CVE-2026-70452, a HIGH-severity security flaw in rsync where a hostname resolution failure in a deny rule causes rsync to skip the rule and fail open, allowing unauthorized access.

    30010224
    5.7K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appsambarsync---

Explore more

Back to dashboardsamba CVEsrsync vulnerabilities