IP Address Spoofing Vulnerability in Rsync Daemon by Rsync Project

CVE-2026-53791

What is CVE-2026-53791?

The Rsync daemon prior to version 3.5.0 is susceptible to an IP address spoofing flaw that enables unauthenticated remote attackers to sidestep IP-based access restrictions. By manipulating the PROXY protocol header to include a counterfeit source IP address, attackers can connect directly to the rsync daemon and bypass existing host allow/deny rules. This vulnerability poses significant risks, as it permits unauthorized access to the system, which is typically reserved for legitimate users based on their actual source addresses.

References