From the NetApp edition of November 5, 2026
NetApp advisory NTAP-20261104-0005 v2.0: critical rsync PROXY IP spoof (CVE-2026-53791); A700s BMC cleared on 5 Nov
NetApp Product Security · Storage vendor security advisory · Global
- Publisher
- NetApp Product Security
- Original publication
- Advisory v2.0, last updated 5 November 2026
- Source retrieved
- 2026-11-06
What happened
On 5 November 2026 NetApp revised NTAP-20261104-0005 to v2.0 for CVE-2026-53791, a critical (CVSS 4.0 score 9.1) rsync flaw through 3.4.4 that can let an attacker who reaches an rsync daemon spoof a PROXY-protocol source IP and bypass host allow/deny rules. The revision moved AFF BMC A700s to Products Not Affected. The official advisory API still lists no products under Affected; Investigating includes FAS/AFF BMC 8300/8700/A400/C400, NetApp HCI BMC H610S, and SolidFire & HCI management and storage nodes. ONTAP 9, AI Data Engine, StorageGRID, SnapCenter and Active IQ Unified Manager appear on the Not Affected list. Status remains Interim; exploitation discussion is public; workarounds: none at this time; no fixes listed.
Why it matters
Relevant to SLED operators who still run older AFF/FAS BMC generations or SolidFire/HCI nodes. Most current ONTAP 9 and AIDE AI-data stacks are listed Not Affected, so the practical risk is concentrated on legacy BMC and HCI management planes rather than primary AI storage controllers.
Evidence and measured results
Opened the rendered advisory page via WebFetch and the official adv_api JSON for NTAP-20261104-0005; read summary, impact, scoring, revision history, investigating and unaffected lists. Vendor self-disclosure; GitHub rsync advisory referenced.
Limitations and uncertainty
Interim; Affected list empty; Investigating products may still be cleared; no workaround or fix published; product lists taken from NetApp adv_api (HTML page did not render the tables).
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- SLED teams need to know whether older NetApp BMC or HCI gear is in scope for the critical rsync advisory.
- Stakeholders
- CISO
- Storage/hardware manager
- Security operations
- Discovery questions
- Which AFF/FAS BMC or SolidFire/HCI platforms do you still operate?
- Can non-admin networks reach BMC or HCI management interfaces?
- Value hypothesis
- A bounded inventory against NetApp’s Investigating list protects trust without overselling risk.
- Potential engagement
- A short BMC/HCI exposure review tied to NTAP-20261104-0005.
- Unsupported claims
- Any Investigating product is confirmed Affected
- ONTAP 9 or AIDE is exposed by this CVE
- Active exploitation in SLED environments
Pre-sales engineering
Role takeaway
- Fit
- SLED estates with Investigating BMC/HCI platforms; low fit for pure ONTAP 9 / AIDE stacks listed Not Affected.
- Architecture and integration
- Isolate BMC and HCI management planes; do not depend on rsync host allow/deny alone.
- Prerequisites
- BMC/HCI inventory
- Management-network reachability map
- Constraints
- Interim advisory
- Empty Affected list
- No published workaround or fix
- Security
- Limit who can connect to potential rsync listeners on Investigating platforms; patch when NetApp publishes fixes.
- Proof of value
- Investigating platforms mapped to inventory
- BMC/HCI management unreachable from non-admin segments
Delivery
Role takeaway
- Work
- Inventory Investigating platforms, restrict management access, track the advisory, apply fixes when listed.
- Dependencies
- NetApp final product disposition and fixes
- Change window for BMC/HCI
- Ownership
- Security operations with the storage hardware owner.
- Skills and adoption
- No new skills; standard firmware and network hygiene.
- Governance checkpoints
- Change approval for BMC/HCI updates
- Close only when Investigating items are cleared or patched
- Acceptance criteria
- All Investigating platforms inventoried against v2.0 lists (proposal)
- Exposed rsync listeners removed or patched (proposal)
- Risks
- Incomplete BMC inventory
- Management interfaces left on user networks
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Restrict direct network access to BMC and SolidFire/HCI management services that may expose rsync; do not rely on IP allow/deny alone for those daemons until Investigating products are cleared or patched.
Governance
Who approves, reviews and stays accountable for outcomes?
Track the interim advisory until Investigating products move to Affected with fixes or to Not Affected; document BMC/HCI inventory against the official lists.
Security and privacy
What data, permissions and controls need testing?
Successful exploitation could disclose sensitive information or add or modify data on reachable rsync services.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Small SLED shops may need partner help to inventory BMC and HCI firmware against the Investigating list.
Procurement
What should contracts, pricing and exit terms secure?
No new purchase signal; existing support contracts cover forthcoming BMC/HCI fixes.
Operating model
Which teams own the service once it runs?
Security operations and storage/hardware owners should jointly track BMC and HCI exposure.
Publication history
- 2026-11-05NetApp · Issue 072 resources
Stable resource ID: netapp-advisory-ntap-20261104-0005-rsync-proxy-spoof-critical-v2-20261105