CVE-2026-53791CWE-290

CVE-2026-53791

Critical · published August 13, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00501 · 42.0th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-08-13T19:19Z
Affected products (1)
ProductVersionsFixed in
samba/rsync< 3.5.03.5.0
References (3)
https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 · [email protected]https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635 · [email protected]https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header · [email protected]
EPSS history
Timeline
  • 13 AUG 14:38Z
    rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header
    cvelistv5