CVE-2026-53786

Executive Summary

CVE-2026-53786 is a filter rule bypass vulnerability in rsync versions prior to 3.5.0. The flaw allows an authenticated client to override module-level filter restrictions by injecting malicious --filter merge file directives during the filter evaluation process, thereby gaining access to files that the daemon administrator intended to exclude.

The vulnerability affects all rsync deployments operating as daemons with module-level filter rules, including enterprise backup servers, file synchronization clusters, and content distribution mirrors. Successful exploitation results in unauthorized read and modification of files that should be inaccessible to remote clients, with the CVSS score of 6.5 (Medium/High) reflecting the moderate confidentiality and integrity impact with no availability loss.

Technical Analysis

rsync's client-server architecture implements a filter system that allows both daemon administrators and clients to define rules controlling which files are transferred, skipped, or deleted during a synchronization operation. Module-level filters are configured on the daemon side to enforce security boundaries — for example, excluding sensitive directories or file types from a public-facing rsync share. These module-level rules are merged with client-supplied filter rules during rsync's file-list construction phase.

The vulnerability exists in how the filter evaluation engine processes --filter merge file directives. A merge file directive specifies a file that contains additional filter rules. The flaw allows an authenticated client to inject client-side merge file directives during filter evaluation, producing rules that supersede the module-level restrictions.

The precise mechanism — whether the issue stems from improper ordering of rule evaluation, incorrect handling of the :F (merge from file) and :P (per-dir merge) modifiers, or a failure to distinguish trusted from untrusted merge sources — is not detailed in the available advisory. However, the core weakness is a logic error in the filter rule precedence system: rules originating from the client are treated as equal to or higher priority than rules defined at the module level. Because daemon-side module filters are the canonical source of truth for access control in rsync's security model, any bypass of these restrictions defeats the intended access control boundary.

The attack surface requires that the target rsync daemon: (1) runs with module-level filter rules designed to exclude specific files, and (2) permits authenticated access (via rsync authentication or allowed IP-based access). The flaw cannot be exploited against rsync deployments not using module filters, as there is nothing to bypass. The vulnerability is network-expoitable over the rsync protocol, typically on default port 873/TCP, or when used over a remote shell transport such as SSH.

The authentication requirement noted in the NVD description is important — the attacker must be able to authenticate to the rsync daemon. However, given that rsync authentication is commonly shared across a user base or configured with widely distributed credentials for read access, this requirement does not substantially raise the exploitation bar.

Exploitation Scenarios

Step 1: Target Reconnaissance and Identification

The attacker first identifies rsync daemons exposed to the network. This can be accomplished with a simple banner grab: connecting to port 873/TCP with a client that requests the module list (rsync --list-modules <target>) reveals the module names and, in some configurations, descriptive metadata. Shodan and other internet-wide scanning platforms index rsync daemons, making this identification trivial. Internal attackers would simply enumerate known backup or mirror servers.

Step 2: Triggering the Filter Bypass

The attacker authenticates to the target rsync daemon and, during the client connection, supplies crafted --filter merge file directives. The malicious directive instructs rsync to merge additional filter rules from a client-controlled path (either a local file on the client or a remote path). The injected rules are constructed such that, upon evaluation, they override the daemon-side module-level exclusion rules. For example, if a module's filter excludes */secure/*, the attacker's injected rules could introduce negation rules (preceded by !) that explicitly re-include that path.

Step 3: Payload Execution and Data Access

Once the filter bypass is effective, the attacker requests a file-list of the module. The rsync server computes the file list by applying the merged filter set — which now includes the attacker's override rules — resulting in paths being included in the transfer list that the module filter was designed to exclude. The attacker runs a standard rsync pull of the module contents and receives the otherwise-restricted files. Similarly, if the module is writable, the attacker could push files into excluded paths by supplying the appropriate override rules.

Step 4: Post-Exploitation Impact

The attacker gains read access to files that the daemon administrator explicitly excluded — potentially containing sensitive configuration, credentials, internal documents, or backup data. In write configurations, the attacker can modify or replace files in excluded directories, which could be used to inject malicious content, corrupt data integrity, or plant malware for lateral movement into the broader environment. In active-passive or rsync-based data replication pipelines, manipulating excluded paths could degrade synchronization integrity and cause cascading failures.

No public PoC has been identified as of this report; the attack chain is inferred from the vulnerability class (filter rule precedence bypass) and standard rsync protocol capabilities.

Impact Assessment

The CVSS score of 6.5 reflects a network-exploitable vulnerability requiring no privileges (PR:N per the vector) but demanding authentication. The Confidentiality and Integrity impact are rated Low (C:L/I:L), which may understate the real-world impact in environments where rsync modules expose sensitive data.

The primary business impact is unauthorized data disclosure — an attacker can read flies excluded from public access, which often constitute the most confidential data on the server (configuration files with secrets, user databases, unreleased code, or proprietary documents). The Integrity impact extends to unauthorized modification of those files for writable modules, enabling data corruption or content injection.

The blast radius for affected enterprises includes:

• Backup infrastructure: rsync is pervasive in backup automation; exposure of backup repositories could leak entire data stores.
• Content delivery/mirror servers: public rsync mirrors risk exposing internal directories if filter rules were intended to partition public from internal content.
• CI/CD pipelines: many build systems use rsync for artifact deployment; bypassing filters could allow attackers to replace binaries or source trees.
• OT/IoT environments: rsync is used for firmware and configuration distribution; a filter bypass could corrupt device images.

The availability impact is None (A:N), meaning the vulnerability cannot be leveraged for direct denial-of-service.

Detection Guidance

Sigma Rule

title: Suspicious rsync Client Filter Merge Directive
id: 87bc1a3c-4d2e-4f2d-9fa6-3b5e0c4f8a11
status: experimental
description: Detects rsync client commands with merge filter directives that may indicate an attempt to bypass module-level filter restrictions
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/rsync'
        CommandLine|contains|any:
            - '--filter=merge'
            - '--filter=-f'
            - '-f :F'
    condition: selection
falsepositives:
    - Legitimate rsync uses with merge files for complex filter setups
level: medium
tags:
    - attack.t1190
    - attack.initial-access
    - cve.2026-53786

YARA Rule

rule rsync_filter_merge_bypass_cve_2026_53786
{
    meta:
        author = "ValtersIT Cyber Threat Intelligence"
        description = "Detects rsync client commands containing filter merge directives potentially exploiting CVE-2026-53786"
        date = "2026-10-01"
        cve = "CVE-2026-53786"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-53786"

    strings:
        $merge1 = "--filter=merge" ascii nocase
        $merge2 = "-f :F" ascii nocase
        $merge3 = "--filter:-f" ascii nocase
        $module = "--module" ascii nocase
        $exclude = "!" ascii

    condition:
        (uint16(0) == 0xEAB2 or filesize < 1MB) and
        1 of ($merge*) and 1 of ($module*)
}

Suricata IDS Rule

alert tcp any any -> any 873 (msg:"ET EXPLOIT rsync Filter Merge Directive Bypass Attempt (CVE-2026-53786)"; flow:established,to_server; content:"--filter"; nocase; content:"merge"; nocase; distance:0; content:"module"; nocase; distance:0; classtype:attempted-admin; sid:5378601; rev:1; metadata:cve CVE-2026-53786, created_at 2026_10_01;)

Elastic Detection

process where event.type == "start" and process.name == "rsync" and
  process.args in ("--filter", "-f") and process.args == "merge" and
  process.args in ("--module", "module") 

Splunk SPL Query

index=endpoint sourcetype=linux_secure OR sourcetype=bash
| where match(command, "(?i)rsync.*(--filter| -f).*merge.*--module")
| stats count by host, user, command
| eval threat = "CVE-2026-53786 Filter Merge Bypass"
| table _time, host, user, command, count, threat

Wazuh OSSEC Rule

<group name="rsync,">
    <rule id="537860" level="8">
        <match>(?i)rsync.*(--filter| -f).*merge.*--module</match>
        <description>rsync client command with filter merge directive - possible CVE-2026-53786 bypass</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>attack.initial_access,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: CVE-2026-53786 is UNPATCHED in the 3.4.x series and earlier. No vendor patch or official workaround was available at the time of this analysis. The fix is planned for rsync 3.5.0 upstream.

Immediate Mitigations:

1. Restrict access to rsync daemons: Where feasible, move rsync traffic to authenticated SSH-based transport (rsync over SSH) rather than exposing rsync --daemon directly. This places the filter bypass behind SSH authentication and reduces the remote attack surface.
2. Apply network-level access controls: Use firewall rules or TCP wrappers to limit which source IPs can connect to the rsync daemon port (873/TCP). This reduces the population of potential attackers, particularly for internet-facing daemons.
3. Review module-level filters for defense-in-depth: For modules containing highly sensitive content, add an additional layer of protection such as separate filesystem permissions or read-only mounts. The filter bypass is protocol-level; filesystem permissions still apply.
4. Monitor daemon logs: Audit rsync daemon logs for connection patterns from unexpected hosts or concurrent connections from multiple IPs, which may indicate reconnaissance or exploitation attempts.

Patch/Upgrade Steps:

1. Monitor the rsync official site (rsync.samba.org) and the rsync-announce mailing list for the 3.5.0 release announcement.
2. When 3.5.0 is released, test it in a staging environment first, paying attention to filter behavior for any regressions.
3. Upgrade all rsync daemon instances. Note that the inherent fix will be in the daemon binary; patching the daemon is sufficient to remediate the vulnerability.
4. Upgrade client binaries at the same time for consistency, though the vulnerability requires a malicious client, the client-side code changes may also include relevant hardening.

Long-Term Hardening:

1. Adopt the principle of least privilege: Configure rsync modules such that the daemon runs with the minimum filesystem permissions needed, so even a filter bypass does not grant access to files the daemon account cannot read.
2. Separate data sensitivity classes: Use different rsync daemons or distinct modules for different sensitivity levels, ensuring that the most confidential data resides behind additional authentication or network isolation.
3. Implement HIDS monitoring: Deploy the detection rules outlined above (Sigma, Wazuh, etc.) and set alerting thresholds to identify anomalous rsync client behavior.
4. Maintain updated CVE monitoring: Subscribe to the rsync-diffs and rsync-announce lists to receive prompt notification of the patch release and any subsequent in-the-wild exploitation campaigns.
5. Consider long-term migration: For critical data movement, evaluate whether a more modern synchronization protocol (e.g., restic, borg, or SFTP-based tooling) is appropriate, given rsync's security track record.

References

1. NVD Entry for CVE-2026-53786 — https://nvd.nist.gov/vuln/detail/CVE-2026-53786
2. rsync Official Project Site — https://rsync.samba.org/
3. rsync-announce Mailing List — https://lists.samba.org/mailman/listinfo/rsync-announce
4. CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
5. CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of report) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

At the time of this report, there are no known threat actor campaigns, exploit-in-the-wild evidence, or public exploit code associated with CVE-2026-53786. This is likely due to the recent disclosure and the lack of a patch. Threat actors that successfully reverse-engineer the filter evaluation logic in rsync 3.4.x may develop weaponized exploits before the 3.5.0 release; organizations running rsync daemons should assume a high risk of future exploitation given the prevalence of rsync in internet-facing infrastructure.