CVE-2026-53791

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/RsyncProject/rsync/releases/tag/v3.5.0	Product Release Notes
https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635	Vendor Advisory
https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header	Release Notes Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*

History

23 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) El demonio rsync anterior a la versión 3.5.0 contiene una vulnerabilidad de suplantación de dirección IP que permite a atacantes remotos no autenticados eludir los controles de acceso basados en IP enviando una cabecera de protocolo PROXY manipulada con una dirección de origen falsificada. Los atacantes que pueden conectarse directamente al demonio rsync pueden inyectar una IP de origen suplantada en la cabecera del protocolo PROXY para eludir las reglas de permitir/denegar de hosts, obteniendo acceso no autorizado que de otro modo sería bloqueado basándose en su dirección de origen real.

Information

Published : 2026-08-13 15:19

Updated : 2026-10-24 16:10

NVD link : CVE-2026-53791

Mitre link : CVE-2026-53791

CVE.ORG link : CVE-2026-53791

JSON object : View

Products Affected

samba

rsync

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2026-53791", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53791", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T18:02:57.002288Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/RsyncProject/rsync", "vendor": "RsyncProject", "product": "rsync", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.4.4"}, {"status": "unaffected", "version": "3.5.0", "versionType": "semver"}], "packageURL": "pkg:github/RsyncProject/rsync", "defaultStatus": "unaffected"}]}], "published": "2026-08-13T15:19:43.363", "references": [{"url": "https://github.com/RsyncProject/rsync/releases/tag/v3.5.0", "tags": ["Product", "Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header", "tags": ["Release Notes", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "rsync daemon before 3.5.0\u00a0contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address."}, {"lang": "es", "value": "El demonio rsync anterior a la versi\u00f3n 3.5.0 contiene una vulnerabilidad de suplantaci\u00f3n de direcci\u00f3n IP que permite a atacantes remotos no autenticados eludir los controles de acceso basados en IP enviando una cabecera de protocolo PROXY manipulada con una direcci\u00f3n de origen falsificada. Los atacantes que pueden conectarse directamente al demonio rsync pueden inyectar una IP de origen suplantada en la cabecera del protocolo PROXY para eludir las reglas de permitir/denegar de hosts, obteniendo acceso no autorizado que de otro modo ser\u00eda bloqueado bas\u00e1ndose en su direcci\u00f3n de origen real."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samba:rsync:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6985EC7E-B9D3-4BD6-96F9-43F8322282E7", "versionEndExcluding": "3.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}