CVE-2026-53791 – rsync

rsync is affected by 33 vulnerabilities, including one Critical, 18 High, and 14 Medium severity issues. CVE-2026-53791 has a CVSS score of 9.1, Critical severity and can allow unauthenticated attackers to spoof source addresses and bypass IP-based access controls. High-severity issues include command injection, out-of-bounds memory writes, authorization bypass, arbitrary file access or writes, TLS certificate validation weaknesses, path traversal, privilege escalation, and denial of service. The High CVSS scores range from 7.1 to 8.2.

The Medium vulnerabilities have CVSS scores ranging from 4.7 to 6.5 and include additional path and symlink weaknesses, memory-safety flaws, authorization bypass, resource exhaustion, and file manipulation risks. Multiple issues affect rsync releases before 3.5.0, with the patch set strengthening memory safety, filesystem confinement, authentication and authorization controls, and daemon resilience.