CVE-2026-70452 is an incorrect authorization vulnerability (CWE-863) in RsyncProject's rsync software versions 3.1.0 up to and including 3.4.4. The rsync daemon uses hostname-based access control rules to restrict access to modules. When a DNS lookup fails for a hostname in a deny rule, the daemon incorrectly skips the rule instead of denying access by default. Attackers who can induce DNS resolution failures can exploit this behavior to bypass module-level IP access controls and gain unauthorized access to restricted file trees. This vulnerability affects network-exposed rsync daemons and requires remote network access.

Successful exploitation allows remote attackers to circumvent hostname-based deny rules in rsync, bypassing IP access controls and gaining unauthorized access to restricted module file trees. This can lead to exposure or unauthorized retrieval of sensitive files served by the rsync daemon. The vulnerability is critical due to its potential for unauthorized data access without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling hostname-based access controls or restricting rsync daemon access to trusted networks only. Monitoring for DNS resolution issues and applying network-level controls may reduce risk.