Rsync EUVD-2026-31013

Exploitation requires three concurrent conditions: (1) the rsync daemon (rsyncd) must be running with chroot enabled in rsyncd.conf - this is the specific configuration that activates the vulnerable hostname-resolution code path; (2) the daemon must have hostname-based 'hosts deny' rules configured, since environments using only IP-based ACLs or no ACLs are not affected; and (3) the attacker must be able to influence or control the PTR (reverse DNS) record for their source IP, or engineer a condition where reverse DNS resolution fails. The CVSS AC:H vector explicitly captures this third requirement as the primary complexity barrier. Exploitation is limited to the scope of modules the bypassed deny rule was protecting - it does not grant broader system access beyond what the targeted rsync module exposes. Attackers on networks where reverse DNS is ISP-controlled and not configurable by the customer cannot satisfy condition (3).

The CVSS 3.1 score of 4.8 (Medium) reflects the realistic attack complexity accurately: AV:N confirms network reachability, but AC:H correctly captures that the attacker must control or influence the PTR record for their source IP - a non-trivial capability requiring either DNS infrastructure control or an ISP/hosting environment where reverse DNS is configurable. PR:N and UI:N confirm no credentials or victim interaction are needed once network access is established. Scope is Unchanged (S:U), and impact is limited to partial confidentiality and integrity (C:L/I:L), with no availability impact. No EPSS score was provided in the source data, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept has been identified. The net risk profile is moderate: the vulnerability is real and exploitable by a capable attacker, but the combination of AC:H (PTR control required), the specific deployment prerequisite (chroot + hostname-based ACLs), and limited impact scores places this below critical triage priority unless the rsync daemon is intentionally internet-facing with hostname-based access controls as the primary security boundary.

An attacker who controls the PTR record for their IP address (e.g., via a self-managed VPS with configurable reverse DNS) points it to a hostname that would normally be caught by a deny rule, or deliberately causes the PTR lookup to fail. When the rsync daemon performs the reverse DNS lookup and receives no valid response, it assigns the connecting client the hostname 'UNKNOWN'. Because the administrator's deny list does not include the literal string 'UNKNOWN', the daemon grants access to the rsync module as if the deny rule did not exist. No public exploit code has been identified at time of analysis.