CVE-2026-53791
9.1CriticalPublished 13 Aug 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-290
Impact
Unauthenticated remote attackers can bypass IP-based access controls to read or modify files guarded by allow/deny rules. They only need direct network access to connect to the rsync daemon port.
Root cause
The rsync daemon trusts unvalidated PROXY protocol headers from direct connections, letting clients spoof their source IP address.
Affected systems
rsync daemon versions prior to 3.5.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade to rsync 3.5.0 or later. If upgrading must wait, block untrusted direct network access to the rsync daemon port using external firewall rules or security groups instead of relying on rsync's internal hosts allow/deny directives.
$ rsync --versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.
References
- https://github.com/RsyncProject/rsync/releases/tag/v3.5.0ProductRelease Notes
- https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635Vendor Advisory
- https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-headerRelease NotesThird Party Advisory