CVE-2026-43617
Description
A flaw was found in rsync. When an rsync daemon is configured with "daemon chroot = /X" and uses hostname-based access control lists (ACLs), and the chrooted directory /X lacks necessary DNS resolution files, a remote attacker can bypass hostname-based deny rules. This occurs because the daemon performs reverse-DNS lookups after chrooting, causing the lookup to fail and the connecting hostname to be identified as "UNKNOWN". An attacker can exploit this by controlling their pointer (PTR) record, enabling unauthorized connections from hostnames that should have been denied.
Statement
This Moderate flaw in rsync allows an attacker to bypass hostname-based access controls on an rsync daemon configured with daemon chroot = /X when the chrooted environment lacks DNS resolution support. This bypass occurs because reverse-DNS lookups fail, causing the connecting hostname to be identified as "UNKNOWN". IP-based access controls are not affected.
Mitigation
To mitigate this issue, ensure that the chrooted environment (`/X`) for any rsync daemon configured with `daemon chroot = /X` includes the necessary DNS resolution files (e.g., `/etc/resolv.conf`, `/etc/nsswitch.conf`, `/etc/hosts`, and NSS service modules). Alternatively, configure rsync daemon access controls using IP addresses instead of hostnames, as IP-based ACLs are not affected. A restart of the rsync service may be required for configuration changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.2 | N/A | 4.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
