{"resourceId":"netapp-advisory-ntap-20261104-0005-rsync-proxy-spoof-critical-v2-20261105","versions":[{"version":"external-1835c10277ab75e98da7cc87b9fbfaf115f0edfc5d2be5b10069a1a886795097","resource":{"id":"netapp-advisory-ntap-20261104-0005-rsync-proxy-spoof-critical-v2-20261105","title":"NetApp advisory NTAP-20261104-0005 v2.0: critical rsync PROXY IP spoof (CVE-2026-53791); A700s BMC cleared on 5 Nov","organization":"NetApp Product Security","sector":"Storage vendor security advisory","geography":"Global","publishedAt":"Advisory v2.0, last updated 5 November 2026","publicationDate":"2026-11-05","eventDate":null,"sourceName":"NetApp Product Security","sourceLabel":"NetApp, Security Advisory NTAP-20261104-0005, v2.0, 5 November 2026","sourceUrl":"https://security.netapp.com/advisory/ntap-20261104-0005","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"On 5 November 2026 NetApp revised NTAP-20261104-0005 to v2.0 for CVE-2026-53791, a critical (CVSS 4.0 score 9.1) rsync flaw through 3.4.4 that can let an attacker who reaches an rsync daemon spoof a PROXY-protocol source IP and bypass host allow/deny rules. The revision moved AFF BMC A700s to Products Not Affected. The official advisory API still lists no products under Affected; Investigating includes FAS/AFF BMC 8300/8700/A400/C400, NetApp HCI BMC H610S, and SolidFire & HCI management and storage nodes. ONTAP 9, AI Data Engine, StorageGRID, SnapCenter and Active IQ Unified Manager appear on the Not Affected list. Status remains Interim; exploitation discussion is public; workarounds: none at this time; no fixes listed.","sledRelevance":"Relevant to SLED operators who still run older AFF/FAS BMC generations or SolidFire/HCI nodes. Most current ONTAP 9 and AIDE AI-data stacks are listed Not Affected, so the practical risk is concentrated on legacy BMC and HCI management planes rather than primary AI storage controllers.","evidence":"Opened the rendered advisory page via WebFetch and the official adv_api JSON for NTAP-20261104-0005; read summary, impact, scoring, revision history, investigating and unaffected lists. Vendor self-disclosure; GitHub rsync advisory referenced.","architectureImplications":"Restrict direct network access to BMC and SolidFire/HCI management services that may expose rsync; do not rely on IP allow/deny alone for those daemons until Investigating products are cleared or patched.","governanceImplications":"Track the interim advisory until Investigating products move to Affected with fixes or to Not Affected; document BMC/HCI inventory against the official lists.","securityPrivacyImplications":"Successful exploitation could disclose sensitive information or add or modify data on reachable rsync services.","caveats":"Interim; Affected list empty; Investigating products may still be cleared; no workaround or fix published; product lists taken from NetApp adv_api (HTML page did not render the tables).","streamIds":["netapp"],"roles":{"sales":"Use this as a care call for customers with older AFF/FAS BMC hardware or SolidFire/HCI, not as a product pitch. NetApp’s 5 November v2.0 of NTAP-20261104-0005 rates CVE-2026-53791 critical (9.1) and clears AFF BMC A700s, while leaving several BMC and HCI products under Investigating and listing ONTAP 9 and AIDE as Not Affected. Offer a short BMC/HCI inventory check against the official lists. Do not claim any Investigating product is confirmed affected, that ONTAP arrays are exposed, or that exploitation has been observed in SLED.","engineering":"Inventory FAS/AFF BMC 8300/8700/A400/C400, HCI BMC H610S and SolidFire/HCI nodes still in the Investigating set, and confirm whether any expose an rsync daemon to non-admin networks. Prefer network isolation of BMC and HCI management planes over trusting IP allowlists until NetApp publishes fixes or clears those products. Treat ONTAP 9 and AIDE as out of scope per the Not Affected list, and re-check the advisory when it moves from Interim.","delivery":"Open a tracking item owned by security operations with the storage hardware owner. Close it only when Investigating BMC and HCI products are patched or formally Not Affected and any exposed rsync listeners are gone. Acceptance criteria below are proposals, not observed results. Main risks are incomplete BMC inventory and management networks still reachable from campus or user VLANs."},"roleDetails":{"sales":{"customerProblem":"SLED teams need to know whether older NetApp BMC or HCI gear is in scope for the critical rsync advisory.","stakeholders":["CISO","Storage/hardware manager","Security operations"],"discoveryQuestions":["Which AFF/FAS BMC or SolidFire/HCI platforms do you still operate?","Can non-admin networks reach BMC or HCI management interfaces?"],"valueHypothesis":"A bounded inventory against NetApp’s Investigating list protects trust without overselling risk.","potentialEngagement":"A short BMC/HCI exposure review tied to NTAP-20261104-0005.","unsupportedClaims":["Any Investigating product is confirmed Affected","ONTAP 9 or AIDE is exposed by this CVE","Active exploitation in SLED environments"]},"engineering":{"fit":"SLED estates with Investigating BMC/HCI platforms; low fit for pure ONTAP 9 / AIDE stacks listed Not Affected.","architectureIntegration":"Isolate BMC and HCI management planes; do not depend on rsync host allow/deny alone.","prerequisites":["BMC/HCI inventory","Management-network reachability map"],"constraints":["Interim advisory","Empty Affected list","No published workaround or fix"],"security":"Limit who can connect to potential rsync listeners on Investigating platforms; patch when NetApp publishes fixes.","proofOfValue":["Investigating platforms mapped to inventory","BMC/HCI management unreachable from non-admin segments"]},"delivery":{"work":"Inventory Investigating platforms, restrict management access, track the advisory, apply fixes when listed.","dependencies":["NetApp final product disposition and fixes","Change window for BMC/HCI"],"ownership":"Security operations with the storage hardware owner.","skillsAdoption":"No new skills; standard firmware and network hygiene.","governanceCheckpoints":["Change approval for BMC/HCI updates","Close only when Investigating items are cleared or patched"],"acceptanceCriteria":["All Investigating platforms inventoried against v2.0 lists (proposal)","Exposed rsync listeners removed or patched (proposal)"],"risks":["Incomplete BMC inventory","Management interfaces left on user networks"]}},"retrievedAt":"2026-11-05T22:07:20-06:00","enrichedAt":"2026-11-05T22:11:06-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Small SLED shops may need partner help to inventory BMC and HCI firmware against the Investigating list.","procurementImplications":"No new purchase signal; existing support contracts cover forthcoming BMC/HCI fixes.","operatingModelImplications":"Security operations and storage/hardware owners should jointly track BMC and HCI exposure.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://security.netapp.com/advisory/ntap-20261104-0005","referenceExcerpt":"inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}