CVE-2026-53791
CRITICAL
CVSS 9.1
rsync
Verified Advisory
IP address spoofing in rsync daemon PROXY protocol handling (CVE-2026-53791)
When `proxy protocol = true` is configured, the rsync daemon (before 3.5.0) accepts PROXY protocol headers from clients connecting directly rather than through a trusted proxy. This allows unauthenticated remote attackers to forge their source IP address and bypass host-based access controls (`hosts allow`/`deny` rules), gaining unauthorized access that would otherwise be blocked.
Affected versions:
- <= 3.4.4
We recommend updating to: 3.5.0.
CVSS 9.1 · our assessment: act_now
Reference: https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635
Details: https://vuln.today/cve/CVE-2026-53791
Verified by vuln.today against published advisories.
Affected versions
- – <= 3.4.4
Fixed in: 3.5.0
More advisories for rsync
- CVE-2026-53790 – Command and argument injection in rsync via unquoted peer- or host-controlled values (CVE-2026-53790)
- CVE-2026-53793 – Chroot inner-module escape via parent-component symlink in rsync (CVE-2026-53793)
- CVE-2026-70452 – hosts deny access control bypass in rsync on DNS lookup failure (CVE-2026-70452)
- CVE-2026-70460 – Module-root escape via symlink in rsync daemon (CVE-2026-70460)
- CVE-2026-44508 – Integer overflow in rsync compressed-token decoder enables remote memory disclosure (CVE-2026-44508)