Is CVE-2026-44507 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44507 being exploited in the wild.

How severe is CVE-2026-44507?

Medium severity, with a CVSS score of 4.8, published 20 July 2026.

Is there a fix for CVE-2026-44507?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44507 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44507?

Check whether you run RsyncProject Rsync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44507: Rsync hostname ACL bypass in chroot daemon mode

CVE-2026-44507 · Severity: medium · CVSS 4.8 · Published 2026-07-20

Rsync is a widely used tool for synchronizing and transferring files between systems. A security flaw in the rsync daemon allows attackers to bypass certain access restrictions that are based on hostnames. If an administrator has blocked specific domains from connecting, an attacker may still be able to gain access if the system is not configured to resolve network names correctly within its restricted environment.

Technologies: RsyncProject Rsync. Vendors: RsyncProject.

Quick answers

Is CVE-2026-44507 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44507 being exploited in the wild.
How severe is CVE-2026-44507?: Medium severity, with a CVSS score of 4.8, published 20 July 2026.
Which products and versions are affected?: RsyncProject Rsync < 3.4.3.
Is there a fix for CVE-2026-44507?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44507 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44507?: Check whether you run RsyncProject Rsync at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in rsync versions prior to 3.4.3 when configured as a daemon using a chroot. The software performs reverse DNS lookups of connecting clients after entering the chroot environment. If the chroot lacks essential glibc resolution files (such as /etc/resolv.conf, /etc/nsswitch.conf, or NSS modules), the lookup fails and the client hostname is set to 'UNKNOWN'. This allows an attacker to bypass 'hosts deny' rules because the specific blocked hostname is never identified. Exploitation requires the attacker to control the PTR record for their source IP and for the server to be using hostname-based ACLs rather than IP-based ACLs. The issue is resolved in version 3.4.3.

Affected products

RsyncProject rsync < 3.4.3

Timeline

2026-05-20: advisory: Initial GitHub advisory published
2026-07-20: disclosed: NVD publication date

References

https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjfm-3w2m-jf4f

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.