CVE-2026-43617 is an authorization bypass vulnerability affecting RsyncProject's rsync daemon versions 3.4.2 and prior. The flaw exists in the hostname-based access control list enforcement when the daemon is configured with chroot. An attacker who controls the PTR record of their source IP can bypass hostname-based deny rules by causing reverse DNS resolution to return a hostname that bypasses restrictions, especially when reverse DNS fails and defaults to UNKNOWN. This allows unauthorized connections that should have been denied based on hostname filtering.

The vulnerability allows attackers to bypass hostname-based deny rules in the rsync daemon, potentially enabling unauthorized access to services that rely on hostname filtering for security. This could lead to unauthorized data synchronization or exposure depending on the rsync daemon's configuration and usage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider alternative access control methods beyond hostname-based filtering, such as IP-based filtering or disabling chroot if feasible, to mitigate risk.