CVE-2026-53791
Received Received - Intake

IP Address Spoofing in rsync Daemon

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-53791
EUVD
EUVD-2026-58099

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rsync rsync to 3.4.4 (inc)
rsync rsync to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects rsync daemon versions before 3.5.0. It allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers can inject a spoofed IP to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked.

Detection Guidance

Check if rsync daemon is running with PROXY protocol enabled by inspecting configuration files for `proxy protocol = true`. Monitor network traffic for PROXY protocol headers containing forged source IPs. Use packet capture tools like tcpdump or Wireshark to analyze incoming rsync connections for malformed PROXY headers.

Impact Analysis

An attacker could exploit this to bypass security controls and access rsync resources they should not be able to. This could lead to unauthorized data transfers, modification of files, or exposure of sensitive information. The high CVSS score (9.1) indicates significant potential impact on confidentiality and integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. Organizations using vulnerable rsync versions may fail to meet access control and data integrity standards, risking legal penalties and reputational damage.

Mitigation Strategies

Upgrade rsync to version 3.5.0 or later immediately. If upgrading is not possible, disable the PROXY protocol feature in rsync configuration or restrict direct client access to trusted networks. Review and tighten host-based access controls to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53791. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart