CVE-2026-53791

CriticalCVSS 9.1/10Last modified Oct 24, 2026

Description

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-537926.5rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to CVE-2026-537937.4rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confCVE-2026-537945.3rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allCVE-2026-537958.1rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination treeCVE-2026-537966.3rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination diCVE-2026-537974.7rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manCVE-2026-537985.3rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackersCVE-2026-537996.3rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extCVE-2026-53805.3An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved. TCVE-2026-538004.7rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink cCVE-2026-538015.9rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause tCVE-2026-538027.1rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process
CVE-2026-53791: Critical severity, CVSS 9.1 | Vulnix