CVE-2026-43617 is an authorization bypass vulnerability affecting rsync versions up to 3.4.2. The flaw exists in the rsync daemon's enforcement of hostname-based access control lists when configured with chroot. Specifically, if reverse DNS resolution fails and defaults to UNKNOWN, an attacker controlling the PTR record for their source IP can bypass deny rules based on hostname, gaining unauthorized access. This vulnerability is network exploitable without user interaction but requires high attack complexity and partial privileges are not required.

The vulnerability allows an attacker to bypass hostname-based deny rules in rsync daemon configurations that rely on reverse DNS for access control. This could lead to unauthorized connections from hosts that administrators intended to block. The impact is limited to scenarios where hostname-based ACLs are used with chroot and reverse DNS resolution is relied upon, with low confidentiality and integrity impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling hostname-based access control lists or avoid relying solely on reverse DNS resolution for access control in rsync daemon configurations. Monitoring and restricting network access to trusted IPs may also reduce exposure.