CVE-2026-53791

The rsync daemon before version 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.

An attacker can gain access to rsync services that should be blocked for their IP address, potentially leading to unauthorized reading or writing of data. This can compromise the confidentiality and integrity of transferred files.

Update rsync to version 3.5.0 or later, which includes the fix. If you cannot update immediately, consider restricting access to the rsync daemon using a firewall or other mechanisms independent of IP address.