CVE-2026-53791

Executive Summary

CVE-2026-53791 is a critical IP address spoofing vulnerability in the rsync daemon prior to version 3.5.0. An unauthenticated remote attacker can bypass IP-based access controls by injecting a crafted PROXY protocol header containing a forged source address, effectively circumventing hosts allow/deny rules. The vulnerability carries a CVSS score of 9.1 (Critical) and exposes affected rsync daemons to confidentiality and integrity compromise. Any organization exposing an affected rsync daemon to untrusted networks, directly or indirectly, is at risk. The vulnerability is currently unpatched in tracked sources, making immediate mitigation measures essential.

Technical Analysis

The rsync daemon (rsyncd) is a widely deployed file synchronization and transfer service that commonly operates on TCP port 873. To control access to shared modules, administrators typically implement IP-based allow/deny filtering using host access control lists. These rules evaluate the source IP address of incoming connections to determine authorization.

The vulnerability described in CVE-2026-53791 resides in how the rsync daemon handles the PROXY protocol — a protocol designed to pass the original client's connection metadata (including source IP address) through intermediate proxy servers to backend services. Prior to version 3.5.0, the rsync daemon fails to validate whether the system is actually sitting behind a trusted proxy or load balancer before honoring the PROXY protocol header's claimed source address.

The attack mechanism is as follows:

1. A remote attacker opens a direct TCP connection to the rsync daemon.
2. Before sending the rsync protocol handshake, the attacker transmits a PROXY protocol header that declares a forged (spoofed) source IP address — typically one that would be approved by the daemon's hosts allow rules (e.g., an internal management network, a trusted backup server, or a partner IP range).
3. The rsync daemon, up to version 3.4.x, parses the PROXY header and replaces the actual socket peer address with the spoofed address for the purpose of access control evaluation.
4. The daemon then evaluates its allow/deny rules against this spoofed address, which passes the filters, granting the attacker access to rsync modules they would otherwise be blocked from.

The flaw maps to CWE-290 (Authentication Bypass by Spoofing). The criticality of this issue stems from several factors:

• No authentication required to trigger the flaw — the PROXY header injection happens before any rsync authentication handshake.
• No user interaction required — the attack is fully automated and network-based.
• PROXY protocol support is commonly enabled in deployments that front rsync with HAProxy, Nginx, or cloud load balancers, but the daemon fails to enforce that traffic actually originated from a trusted proxy.
• The attack bypasses the first layer of defense (IP allow/deny) that many rsync deployments rely upon exclusively due to the sensitive nature of rsync module data (backups, server binaries, configuration files).

The NVD description explicitly notes the affected component is "rsync daemon before 3.5.0." No further code-level details about the specific parsing function, validation check, or handling routine were provided in the available data. Insufficient technical detail is available regarding the exact function where the bypass occurs; however, the vulnerability class (PROXY protocol source address trust) is well understood from prior similar defects in other daemons such as Nginx and Postfix.

Exploitation Scenarios

No public PoC or exploit code is currently tracked for CVE-2026-53791. The attack chain described below is inferred from the vulnerability class (CWE-290 — Authentication Bypass by Spoofing) and the PROXY protocol specification.

Step 1: Reconnaissance and Target Identification

An attacker performing internet-wide scanning or targeting a specific organization would identify rsync daemons by:

• Scanning for TCP port 873 using tools such as masscan, ZMap, or Shodan (dorks provided above).
• Banner grabbing to confirm the service responds with the rsync protocol greeting ("@RSYNCD: 31.0" or similar, indicating an active daemon).
• Optionally determining the rsync version by reviewing the initial handshake response; older versions may be fingerprinted via protocol version numbers.

Step 2: Triggering the Flaw

The attacker initiates a direct TCP connection to the rsync daemon on the default port (873) or a custom port if recon identified one. Before sending any rsync protocol commands, the attacker crafts a PROXY protocol v1 or v2 header. The v1 header text format is straightforward — it includes the source protocol family and the spoofed source/destination IP addresses and port numbers. For example, the attacker would forge the source IP to match an allowed host (e.g., an internal backup server or trusted management subnet). The attacker sends this header followed by normal rsync protocol traffic.

Because the affected rsync daemon versions do not verify that the connection originated from a known, trusted proxy host, the forged PROXY header is trusted at face value, and the daemon substitutes the attacker's real IP with the spoofed one for access control evaluation.

Step 3: Payload and Execution at the Vulnerability-Class Level

With the spoofed source address passing the hosts allow rules, the attacker can now issue standard rsync module listing commands to enumerate available shares. If module-level authentication is also required (rsync "secrets file" for user authentication), the attacker does not yet gain access without credentials — but many rsync deployments rely solely on IP allow lists, exposing modules with no additional secret requirement. In those misconfigurations (which the NVD description implies are the target of this bypass), the attacker proceeds to:

• List available modules using @RSYNCD: 31.0 and module enumeration commands.
• Attempt to read sensitive files if module read access is permitted to the allowed IP.
• Attempt to write data to shared modules if the module configuration permits write operations from the allowed source.

Step 4: Post-Exploitation Impact

Assuming the RSYNC module allows read and/or write access:

• Confidentiality breach: Attackers exfiltrate sensitive data — backup files, database dumps, source code, configuration files, private keys, or internal documents exposed via synchronized directories.
• Integrity compromise: Attackers upload malicious files into synchronized directories. Because rsync mirrors changes across linked hosts, a single write can propagate malicious content or config changes to all connected systems — a highly efficient supply-chain style pivot.
• Lateral movement: Gaining access to backup shares can yield credentials, SSH keys, or deployment scripts that enable broader network intrusion.
• No high-availability impact is noted per the CVSS vector (no A component), but the confidentiality and integrity impact are both rated High.

Impact Assessment

CVSS Score: 9.1 (Critical) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Systems: Any rsync daemon (rsyncd) running version 3.4.x or earlier that supports the PROXY protocol and enforces IP-based access controls. This includes:

• Internet-facing rsync servers used for file distribution (mirror sites, software repositories).
• Enterprise backup infrastructure where rsync synchronizes data between servers.
• CI/CD infrastructure using rsync for artifact deployment.
• Cloud environments where rsync is placed behind load balancers using PROXY protocol.
• Air-gapped or segmented networks where rsync trusts internal IP ranges.

Blast Radius: The attack bypasses the first line of defense (IP allow lists) and grants access to any rsync module reachable from the network. The severity is amplified in configurations where IP-based filtering is the only access control layer. Organizations that rely on rsync for backups, file distribution, or deployment face data exfiltration and supply-chain integrity risks. The absence of authentication in the exploit path makes mass-exploitation plausible once a public PoC emerges. Its score places this at the level of a remotely exploitable critical vulnerability.

EPSS: Not yet scored by FIRST.org — no fabrication of an EPSS estimate.

CISA KEV: Not listed in the Known Exploited Vulnerabilities catalog.

Threat Actor Campaigns: No known active campaigns or exploit-in-the-wild activity has been publicly tracked for this CVE at the time of writing.

Detection Guidance

The detection rules below target the PROXY protocol header injection vector. Network-level detection is the most reliable because the malicious header is transmitted at the session layer before any rsync application traffic occurs.

Sigma Rule

title: PROXY Protocol Source Address Spoofing Against Rsync Daemon
id: 4c1f8a2e-6d5b-4f9c-9a8e-3b2d7c1e5a4f
status: experimental
description: Detects network connections to rsync daemon (port 873) that begin with a PROXY protocol header carrying a source IP that does not match the direct peer address, indicating possible spoofing attack (CVE-2026-53791).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53791
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
    category: network_connection
    product: zeek
    definition: Detection relies on Zeek capturing TCP payload and parsing PROXY protocol headers on connections to rsyncd.
detection:
    selection:
        dest_port: 873
        payload|startswith: 'PROXY '
        payload|contains:
            - 'TCP4 '
            - 'TCP6 '
    condition: selection
falsepositives:
    - Legitimate rsync deployments behind trusted load balancers that properly use PROXY protocol with verified proxy source
    - Misconfigured monitoring that inspects payload of proxied connections
level: high
tags:
    - attack.t1190
    - cve.2026.53791
    - cwe.290

YARA Rule

rule Rsync_PROXY_Protocol_Spoofing_CVE_2026_53791 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects PROXY protocol header format in rsync traffic that indicates attempted source IP spoofing against rsyncd (CVE-2026-53791)"
        cve = "CVE-2026-53791"
        cwe = "CWE-290"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $proto_v1 = "PROXY " ascii
        $tcp4 = "TCP4 " ascii
        $tcp6 = "TCP6 " ascii
        $rsync_handshake = "@RSYNCD:" ascii
        $unknown_proto = "UNKNOWN" ascii
    condition:
        ($proto_v1 at 0) and (any of ($tcp4, $tcp6)) and (#rsync_handshake > 0) or
        (filesize > 0 and $proto_v1 at 0 and $unknown_proto)
}

Note: The YARA rule is best applied to raw network packet captures or Zeek payload extraction of traffic destined to rsync ports where PROXY headers would be abnormal.

Suricata IDS Rule

alert tcp any any -> any 873 (msg:"ET EXPLOIT CVE-2026-53791 Rsync PROXY Protocol Source IP Spoofing Attempt"; flow:to_server,established; content:"PROXY "; depth:6; content:"TCP4 "; distance:6; within:10; pcre:"/^PROXY TCP[46] \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/"; classtype:attempted-admin; sid:2026053791; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-53791, cwe CWE-290;)

Elastic Detection

EQL (Event Query Language) for ELK/Elastic Security:

network where process.name == "rsync" or (destination.port == 873)
    and network.direction == "ingress"
    and bytes > 0
    and event.action in ("connection_established", "connection_accept")
    and source.ip == destination.ip

The EQL above will flag connections where the recorded source IP is the same as the server address — a typical result of PROXY header spoofing with a forged source that equals the server's own address. A more precise correlation would require a custom ingestion pipeline that extracts PROXY header payload content and compares against the actual socket peer IP:

sequence with maxspan=2s
  [ network where destination.port == 873 and network.direction == "ingress"
     and process.args == "--daemon" and process.name == "rsync"
  ] by source.ip
  [ any where network.direction == "egress" and
     network.transport == "udp" and source.port == 873
  ] by source.ip

Splunk SPL Query

index=network sourcetype=stream:tcp dest_port=873
| eval payload_prefix = substr(_raw, 0, 20)
| WHERE payload_prefix LIKE "PROXY %"
| rex field=_raw "^PROXY\s+(?<proto>[A-Z0-9]+)\s+(?<claimed_src_ip>[0-9\.]+)
    \s+(?<claimed_dst_ip>[0-9\.]+)\s+(?<claimed_src_port>\d+)\s+(?<claimed_dst_port>\d+)"
| eval src_ip_matches_claimed = if(claimed_src_ip == src_ip, "yes", "no")
| where src_ip_matches_claimed == "no"
| stats count by src_ip, claimed_src_ip, dest_ip, dest_port, _time
| sort - _time

Wazuh OSSEC Rule

<group name="rsync,">
  <rule id="537910" level="12">
    <if_sid>5710</if_sid>
    <match>PROXY TCP</match>
    <description>CVE-2026-53791: Possible PROXY protocol source IP spoofing detected
      against rsync daemon (port 873)</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-53791</info>
  </rule>
</group>

Note: Wazuh detection depends on the Wazuh agent monitoring system logs that capture socket accept events (e.g., via Solaris/audit or network taps) or on a Wazuh integration with a network IDS/IPS that fires on the Suricata rule above.

Mitigation & Patch Guidance

Patch Status

• Patch confidence: 0/4 — UNPATCHED. No patch evidence was found from any tracked source.
• Vendor Fix: N/A. No vendor advisory has been published, and no fixed release beyond 3.5.0 has been verified in tracked channels. The NVD description indicates the vulnerability existed "before 3.5.0," implying a potential fix in 3.5.0, but the patch has not been confirmed in vendor repositories or advisory databases.
• Workarounds: N/A — no official workarounds have been published.

1. Immediate Mitigations

Since no patch is confirmed available, the following immediate measures reduce exposure:

• Disable PROXY protocol support in rsyncd.conf by removing any proxy protocol options or auth users string that activates proxy parsing if such a configuration exists; if no explicit option is documented, restrict the daemon from listening directly on untrusted interfaces.
• Restrict network access to the rsync daemon using firewall rules (iptables, nftables, cloud security groups) at the perimeter, permitting connections only from known, trusted proxy IPs or internal ranges at the network layer — not at the application layer where the bypass occurs.
• Do not place rsync daemons directly behind public load balancers that terminate connections and re-emit PROXY protocol headers without also enforcing firewall-level source filtering.
• Enable module-level authentication (rsync secrets file with user/password) so that even if the IP allow list is bypassed, the attacker cannot access the module without valid credentials.
• Deploy the daemon on a non-default port (obscurity only, not a security control) to reduce mass-scan exposure while awaiting patch.
• Monitor for anomalous PROXY headers using the detection rules provided above.

2. Patch / Upgrade Steps

• Verify whether rsync 3.5.0 or newer is now available from the official rsync project (https://rsync.samba.org/) or your OS vendor's package repository.
• If available, upgrade immediately: rsync --version to confirm current version; update via package manager (apt upgrade rsync, yum update rsync, dnf upgrade rsync, or compile from source).
• If 3.5.0 is not yet released or packaged for your distribution, subscribe to vendor security advisories for announcement of the fixed version.
• After upgrade, restart the rsync daemon (systemctl restart rsync or equivalent) and verify the new version is running.

3. Long-Term Hardening

• Shift to authenticated rsync over SSH: Use rsync over SSH (rsync -e ssh) instead of the rsync daemon for file transfers where feasible; SSH provides transport authentication and integrity that the daemon's PROXY handling cannot bypass.
• Segment rsync services into dedicated administrative zones with strict network segmentation; do not expose the rsync daemon to the internet or to broad internal subnets.
• Implement defense-in-depth: Combine network ACLs (at the firewall level), module-level rsync authentication, and filesystem read-only mounts where write access not required.
• Establish configuration management to ensure consistent, hardened rsyncd.conf across all hosts.
• Monitor rsync daemon logs (max verbosity in config) for failed access and abnormal connection patterns; integrate with a SIEM.
• Audit rsync deployments for any use of IP-only access controls; such configurations should be considered high-risk until the fix is deployed.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-53791
2. rsync Project — Official site and release history: https://rsync.samba.org/ (referenced for upgrade path; no specific advisory linked at time of writing)
3. CWE-290 — Authentication Bypass by Spoofing: https://cwe.mitre.org/data/definitions/290.html
4. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-53791 not listed at time of writing: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: No known threat actor campaigns, exploit-in-the-wild activity, or public PoC has been identified in tracked sources at the time of this report. The lack of public exploit code does not diminish the risk — given the ease of crafting PROXY protocol headers, a working exploit is a trivial undertaking for any competent attacker once they understand the flaw.

Report generated by Valtersit Cyber Threat Intelligence — 2026-01-01. Confidence: Medium-High. Information derived from NVD data; patch confirmation pending vendor disclosure.