A critical (CVSS 9.1) authentication-bypass flaw in rsync daemon versions before 3.5.0 lets unauthenticated remote attackers forge their source IP in a PROXY protocol header to defeat hosts allow/deny rules.
What Is It
rsync daemon before 3.5.0 contains an IP address spoofing vulnerability (CWE-290, Authentication Bypass by Spoofing). An unauthenticated remote attacker who can connect directly to the daemon sends a crafted PROXY protocol header containing a forged source address. The daemon trusts that header for access-control decisions, so the attacker's real source IP is never evaluated against the configured rules.
The result is unauthorized access to daemon modules that the operator explicitly intended to block. The CNA, VulnCheck, scores the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N at 9.1 CRITICAL, network attack vector, low complexity, no privileges, no user interaction, with high confidentiality and integrity impact. A separate CVSS 4.0 vector is also supplied by the CNA. NVD has not published its own analysis or score for this CVE.
Why It Matters
IP allowlisting is frequently the only control standing in front of an rsync daemon. Many deployments expose modules read-only or read-write on the assumption that hosts allow restricts them to a known set of backup servers or internal ranges. This bug collapses that assumption: the attacker simply claims to be an allowed address.
High confidentiality and integrity impact reflects what rsync modules typically hold; backups, source trees, configuration, and file sets that may be writable. No credentials and no user interaction are required. The CNA's CVSS 4.0 vector marks attack requirements as PRESENT, meaning the attacker needs direct network reachability to the daemon.
CVE-2026-53791 does not appear in the CISA Known Exploited Vulnerabilities catalog, and there is no evidence of active exploitation on record.
What's Vulnerable
- Vendor/Product: RsyncProject rsync
- Affected: all versions up to and including 3.4.4 (daemon mode)
- Unaffected: 3.5.0 and later
Only the rsync daemon is implicated by the description; the vulnerability is exercised against daemon-mode listeners reachable by the attacker.
Patch Status
Fixed in rsync 3.5.0. Upgrade to 3.5.0 or later. Where immediate patching is not possible, the exposure is limited to attackers who can connect directly to the daemon, so restricting network reachability to the listener at the perimeter reduces the attack surface. Because the CVE is absent from the CISA Known Exploited Vulnerabilities catalog, no BOD 22-01 remediation deadline applies.
The CVE was published 2026-08-13 and disclosed via VulnCheck. NVD status is still "Received," so NVD analysis, scoring, and CPE enumeration are all pending; the severity figures above should be read as CNA-assigned and may change once NVD completes its review.