CVE-2026-53791

Katalog CVE

CVSS 9.1 · Critical EPSS 0,50%

Kerentanan Authentication Bypass by Spoofing pada samba rsync. Skor CVSS 3.1 9.1 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635 advisory vendor
• https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header release notes · advisory pihak ketiga
• https://github.com/RsyncProject/rsync/releases/tag/v3.5.0 product · release notes