CVE-2026-43617

A flaw was found in rsync. When an rsync daemon is configured with "daemon chroot = /X" and uses hostname-based access control lists (ACLs), and the chrooted directory /X lacks necessary DNS resolution files, a remote attacker can bypass hostname-based deny rules. This occurs because the daemon performs reverse-DNS lookups after chrooting, causing the lookup to fail and the connecting hostname to be identified as "UNKNOWN". An attacker can exploit this by controlling their pointer (PTR) record, enabling unauthorized connections from hostnames that should have been denied.

This Moderate flaw in rsync allows an attacker to bypass hostname-based access controls on an rsync daemon configured with daemon chroot = /X when the chrooted environment lacks DNS resolution support. This bypass occurs because reverse-DNS lookups fail, causing the connecting hostname to be identified as "UNKNOWN". IP-based access controls are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that the chrooted environment (/X) for any rsync daemon configured with daemon chroot = /X includes the necessary DNS resolution files (e.g., /etc/resolv.conf, /etc/nsswitch.conf, /etc/hosts, and NSS service modules). Alternatively, configure rsync daemon access controls using IP addresses instead of hostnames, as IP-based ACLs are not affected. A restart of the rsync service may be required for configuration changes to take effect.