CVE-2026-43617: rsyncproject rsync Authentication Bypass by Alternate Name

Vulnerability summary

CVE-2026-43617 is a medium (CVSS 6.3) Authentication Bypass by Alternate Name vulnerability in rsyncproject rsync. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 22.9% of scored vulnerabilities.

Timeline

1. 20-05-2026
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass hostname-based deny rules by controlling the PTR record for their source IP address, allowing connections from hostnames that administrators intended to deny when reverse DNS resolution fails and defaults to UNKNOWN.

• CWE-289Authentication Bypass by Alternate NameThe product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.