CVE-2026-53791

A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources.

A flaw was found in the rsync daemon. When configured to use the PROXY protocol, an unauthenticated remote attacker can bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address. This allows unauthorized access to restricted resources.

Note: Red Hat Enterprise Linux 8 and earlier versions do not contain the vulnerable PROXY protocol implementation and are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict rsync daemon TCP/873 to the trusted proxy only (CME-202). If PROXY protocol is unused, leave proxy protocol disabled (the default).