CVE-2026-44507 is an incorrect authorization vulnerability (CWE-863) in rsync before version 3.4.3. When running an rsync daemon with chroot enabled, reverse DNS lookups of connecting clients occur after entering the chroot environment. If the chroot lacks essential files for DNS resolution (e.g., /etc/resolv.conf, /etc/nsswitch.conf, /etc/hosts, NSS modules), the lookup fails and the hostname defaults to "UNKNOWN". Consequently, hostname-based deny rules cannot match the client, allowing an attacker who controls the PTR record of their IP address to bypass these hostname-based restrictions. IP-based ACLs are not affected. The vulnerability is resolved in rsync 3.4.3.

The vulnerability allows an attacker to bypass hostname-based access control deny rules if they control the PTR record of their source IP address. This could lead to unauthorized connections to the rsync daemon when hostname-based restrictions are relied upon. However, IP-based access controls remain effective and are not impacted by this issue. There is no indication of impact on confidentiality, integrity, or availability beyond the bypass of hostname-based restrictions.

Upgrade rsync to version 3.4.3 or later, where this issue is fixed. Until then, avoid relying solely on hostname-based deny rules when using rsync daemons configured with chroot. Use IP-based access controls as they are unaffected by this vulnerability. Patch status is not explicitly stated in the vendor advisory, but the fix is included in version 3.4.3.