External risk intelligence

Rsync Daemon IP Spoofing Vulnerability via Crafted Proxy Protocol Header

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-53791

Rsync is primarily a file synchronization utility often used over SSH or in internal environments. While rsync daemon mode can be exposed to the internet, it is not a default internet-facing gateway or public-facing service in common standard deployments, making internet-reachable instances possible but not the standard design pattern.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the rsync daemon could allow unauthenticated remote attackers to bypass access controls by spoofing IP addresses. This issue affects systems using the rsync daemon that are exposed to the internet and rely on IP-based access rules for security. While rsync is typically used for file synchronization, its daemon mode, if improperly configured and exposed, presents a potential risk.

Unauthenticated attackers can spoof IPs to bypass access controls.
This impacts systems using rsync daemon with IP-based access rules.
Confirm relevance and exposure of internet-facing rsync daemons.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can bypass access controls by sending a specially crafted PROXY protocol header with a forged source IP address directly to an exposed rsync daemon. This allows them to circumvent host allow/deny rules that would normally prevent access, potentially gaining unauthorized entry to the system. The vulnerability can lead to unauthorized access and data compromise.

Attacker connects to rsync daemon.
Sends crafted PROXY protocol header.
Unauthorized access granted.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an IP address spoofing vulnerability in the rsync daemon could allow unauthenticated remote attackers to bypass IP-based access controls. This can be achieved by sending a crafted PROXY protocol header with a forged source address to circumvent host allow/deny rules, leading to unauthorized access that would otherwise be blocked.

Unauthorized access to rsync daemon.
Spoofing IP address via PROXY protocol header.
Bypass IP access controls.

Operational Fix

Recommended remediation, mitigation, and detection steps

The rsync daemon's IP address spoofing vulnerability primarily impacts teams responsible for the infrastructure where rsync is deployed and the security teams managing network access controls. The first practical step is to locate all rsync daemon instances, determine their exposure and business criticality, and identify the accountable owner for each. Once identified, a risk-based remediation plan can be developed, potentially involving coordination with vendor-management teams if rsync is part of a third-party solution.

Infrastructure and Security teams own this.
Verify rsync daemon reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is rsync and its daemon mode?

Rsync is a widely used command-line utility for efficiently synchronizing files between directories or networked systems. Its daemon mode allows it to run as a background service that listens for incoming connections, enabling centralized file transfers without requiring individual SSH user accounts for every connection.

How does CVE-2026-53791 affect security controls?

This vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), allows an attacker to masquerade as a trusted user. By injecting a forged IP address into a PROXY protocol header, the attacker can deceive the rsync daemon into thinking the connection originated from an authorized location, effectively neutralizing IP-based allow/deny access rules.

Do I need to be a local user to trigger this bug?

No. The vulnerability is triggered remotely by an unauthenticated attacker who has direct network reachability to the rsync daemon. If the daemon is not accessible from the network or is configured to ignore the PROXY protocol header, this specific spoofing attack vector cannot be initiated against the service.

Is my infrastructure at risk from this rsync issue?

According to Halo Surface Signal, risk depends on how your service is positioned. While rsync is not a standard internet-facing gateway, any instance exposed to the internet increases your risk profile. You should prioritize assessing instances where network-level access controls are your primary defense against unauthorized connections.

How do I start managing this risk?

Begin by auditing your environment to locate all active rsync daemon instances. Document their network exposure and determine which ones rely on IP-based filtering for access control. Once the inventory is mapped, coordinate with the designated system owners to schedule the update to version 3.5.0 or later to resolve the underlying weakness.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.