CVE-2026-53796

Executive Summary

CVE-2026-53796 is a time-of-check to time-of-use (TOCTOU) race condition affecting rsync versions before 3.5.0, specifically in the non-daemon receiver's destination directory handling. An attacker with local, low-privileged access who can manipulate the parent components of a destination path can substitute a symlink between path resolution and the chdir() call, causing rsync to establish its working directory outside the intended destination tree and write files to unintended filesystem locations. The vulnerability carries a CVSS base score of 6.3 (high integrity and availability impact, no confidentiality impact) and is not currently listed in CISA's Known Exploited Vulnerabilities catalog; no public exploit code or PoC has been confirmed.

Technical Analysis

The NVD description identifies a classic link-following race condition classified under CWE-59 (Improper Link Resolution Before File Access). The affected code path is the destination directory handling of the rsync non-daemon receiver — i.e., the rsync process acting as a client that receives files and writes them to a local destination directory, as opposed to the rsync daemon listening on TCP/873.

The root cause is a TOCTOU gap between two distinct operations:

1. Path resolution — rsync resolves the destination path (performing checks against the resolved target, such as confirming it is the intended directory) at one point in time.
2. chdir() — at a later point, the receiver changes its working directory into that resolved destination path.

Between these two operations, an attacker who has write and execute (traverse) permissions on any parent component of the destination path can swap that component with a symlink pointing to an arbitrary directory of the attacker's choosing. When rsync subsequently executes chdir(), it follows the substituted symlink and the receiver's working directory is established outside the intended destination tree. All subsequent relative-path file writes performed by the sync operation then land in unintended filesystem locations — directories the victim account can otherwise write to but which were never intended as the sync target.

Several characteristics of the flaw are notable from the advisory data:

• Attack complexity is high (AC:H). The race window between path resolution and chdir() is short, and the attacker must win the race reliably. Additionally, the attacker needs the ability to perform filesystem mutations (rename/unlink/create symlink) on a parent directory of the destination path. This typically requires that the destination path reside beneath a directory with permissive or attacker-writable permissions (e.g., shared temporary directories, multi-user workspace directories, or world-writable parent components).
• Privileges required are low (PR:L). The attacker does not need elevated privileges; only filesystem-level control of a parent path component and the ability to time the race.
• No user interaction is required (UI:N). The attack is triggered by concurrently manipulating the filesystem while an rsync receiver job runs; the victim (or an automated job such as a cron-driven sync/backup) need not perform any interactive action.
• Impact is scoped to integrity and availability (I:H, A:H). The attack redirects writes but does not directly disclose data, hence C:N. Because the writes are redirected, files at the attacker-chosen destination can be corrupted or overwritten, and legitimate sync/backup data may be written to the wrong location, causing integrity loss and denial/availability impact on the intended destination content.

The advisory data lists affected versions as rsync versions prior to 3.5.0 ("rsync before 3.5.0"), with the OSV package entry showing a generic package with an unfixed state (0→unfixed), while a single OSV source claims a patch exists. No vendor-supplied workaround or detailed vendor fix note is provided, and no additional implementation-level detail (function names, exact chdir() call sites, or specific inode-resolution flags) is disclosed beyond the description. Further technical detail is insufficient to identify the precise code location responsible for the gap.

Because the vulnerable mode is the non-daemon receiver, network exposure via the rsync protocol (port 873) is not the primary attack surface. The vulnerability is exercised locally: the attacker must be present on the same host (or be able to mutate the filesystem of the host) and must target a directory tree that is used as the destination for an rsync client operation.

Exploitation Scenarios

No public PoC or confirmed exploit code is available for CVE-2026-53796; the following attack chain is inferred from the vulnerability class (CWE-59 TOCTOU symlink race) and the operation sequence described in the NVD entry.

Step 1 — Reconnaissance and target identification. The attacker identifies a host running rsync before 3.5.0 where automated or user-initiated rsync client operations write to a local destination directory. Common candidates include backup scripts, file-staging directories, CI/CD workspace synchronization, and user-to-user sync jobs. The attacker then identifies a destination path whose parent components are writable by their own low-privileged account — for example, a destination directory nested beneath a shared world-writable directory (/tmp, /var/tmp, /dev/shm, shared project directories). The attacker also confirms that the rsync process runs with sufficient privileges (or that the target location of the redirected writes is owned by a more privileged account) to make the redirected writes impactful.

Step 2 — Triggering the race. The attacker waits for an rsync receiver operation targeting the destination path (or induces it where possible). During the window between rsync's initial path resolution and the subsequent chdir() into the destination, the attacker replaces a parent component of the destination path with a symlink. The symlink points to an attacker-chosen directory outside the intended destination tree — for instance, another user's home directory, a configuration directory, or a directory whose contents are subsequently consumed by a privileged process. The substitution can be performed with standard filesystem operations such as rename()/symlink()/unlink() loops to maximize the chance of winning the race.

Step 3 — Payload/execution at the vulnerability-class level. Once the symlink is followed and rsync's working directory is established in the attacker-chosen location, all subsequent relative-path file writes are redirected. The files being transferred by the sync job (which may be controlled or partially controlled by the attacker, or may simply be files the victim intends to sync) are written into the unintended location. At the vulnerability-class level, this is a redirected file-write primitive constrained by the privileges of the rsync process and the file permissions of the unintended destination. The attacker does not execute arbitrary code directly, but can influence which files are overwritten and their content. If the unintended destination contains files that are later executed or interpreted by other users or automated jobs (e.g., shell profiles, cron entries, application configuration, library paths, or scripts), the attacker may chain this write-redirection into broader integrity compromise or local privilege escalation.

Step 4 — Post-exploitation impact. Successful exploitation results in high integrity and availability impact:

• Files in the unintended location are overwritten or corrupted with content from the redirected sync operation.
• The intended destination directory is left incomplete or missing files, breaking the legitimate sync/backup workflow (availability).
• If the overwritten files are trusted inputs for other processes, the attacker gains a foothold that can be escalated — e.g., planting a cron job, altering a configuration file read by a service, or poisoning a build/CI workspace — potentially leading to unauthorized local privileges or persistent manipulation.

The high attack complexity means reliable exploitation requires repeated attempts or a cooperative scheduling condition, but automated jobs that run rsync on a fixed schedule provide repeated opportunities for the attacker to win the race.

Impact Assessment

The CVSS v3.1 vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H, yielding a base score of 6.3 (Medium). The subscores map to:

• Attack Vector (AV:L): Local only. The attacker must have filesystem-level access to the host where the rsync receiver runs. Not remotely exploitable over the network.
• Attack Complexity (AC:H): The race window is short and timing-dependent; success requires the ability to substitute the symlink within the gap between path resolution and chdir().
• Privileges Required (PR:L): Low-privileged local access is sufficient, provided the attacker can mutate a parent component of the destination path.
• User Interaction (UI:N): None. The attack races an automated or non-interactive rsync operation.
• Scope (S:U): Unchanged. The compromised component is the rsync receiver process; the redirected writes stay within the same host.
• Confidentiality (C:N): No direct information disclosure.
• Integrity (I:H): High — files can be written, overwritten, or corrupted in unintended filesystem locations.
• Availability (A:H): High — legitimate sync/backup destinations can be rendered incomplete, and target filesystem locations can be damaged.

Business impact. Organizations relying on rsync for backup, file distribution, deployment pipelines, or data staging on multi-user Linux/Unix systems are the primary stakeholders. The attack is most realistic on shared or multi-tenant hosts, lab/CI infrastructure, and any environment where low-privileged users share filesystem space with automated rsync jobs. Because the vulnerable mechanism is the client-side receiver, systems that only run rsync daemon mode (or only pull from remote rsync daemons into well-protected, root-owned directories) have a reduced attack surface; by contrast, client pull/push jobs writing into permissive directory trees are exposed. The lack of confidentiality impact limits direct data-theft scenarios, but the integrity/availability combination is sufficient for sabotage, configuration poisoning, and potential supply-chain-style manipulation of staged artifacts.

Exploit likelihood. EPSS score is 0.00094 (0.7th percentile of exploited CVEs), indicating a very low current probability of exploitation in the wild. CISA KEV does not list this CVE, and no public PoC, Nuclei template, or exploit code is confirmed. The high attack complexity and the requirement for local parent-directory write access are significant practical barriers.

Detection Guidance

The following detection content is provided as guidance. Because CVE-2026-53796 is a local filesystem race condition (not a network-reachable flaw), the most effective telemetry sources are process execution logs (rsync invocations and destination paths) and filesystem audit logs (symlink/rename syscalls). Network detection has limited utility for this specific vulnerability and is included solely for broad rsync activity telemetry. No vendor- or researcher-published detection signatures exist for this CVE, so the rules below are heuristic and should be validated and tuned against local baselines.

Sigma Rule

title: CVE-2026-53796 - Rsync Client Execution with Raceable Destination Path
id: 4f6d9c2e-8b1a-4a5e-9c3d-2b7f0a1e5c9a
status: experimental
description: >
  Detects rsync client (non-daemon) process starts where the destination path
  is located beneath world-writable or shared temporary directories, which is a
  precondition for the CVE-2026-53796 TOCTOU symlink race in the receiver's
  destination directory handling.
author: Valters IT SOC
date: 2026/06/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_rsync:
    Image|endswith: /rsync
  selection_writable_parent:
    CommandLine|contains:
      - /tmp/
      - /var/tmp/
      - /dev/shm/
  condition: selection_rsync and selection_writable_parent
falsepositives:
  - Legitimate rsync staging jobs that intentionally use world-writable temporary directories
  - Automated backup scripts writing to /tmp before moving files to protected storage
level: medium
tags:
  - attack.t1574
  - cwe.59
  - cve.2026-53796

YARA Rule

/*
   CVE-2026-53796 heuristic YARA rule.
   Targets shell scripts or binary code artifacts that implement a symlink
   substitution loop against an rsync destination path (race primitive).
   Not a signature for the vulnerable rsync binary itself.
*/
rule CVE_2026_53796_Rsync_Symlink_Race
{
    meta:
        author = "Valters IT SOC"
        description = "Heuristic detection of scripts/binary shreds performing symlink substitution to race rsync destination path resolution (CVE-2026-53796)"
        cve = "CVE-2026-53796"
        cwe = "CWE-59"
        date = "2026-06-01"
    strings:
        $rsync = "rsync" nocase
        $symlink_short = "ln -s" nocase
        $symlink_force = "ln -sfn" nocase
        $unlink = "unlink " nocase
        $rename = "mv " nocase
        $loop_for = "for i in" nocase
        $loop_while = "while" nocase
        $tmp = /\.(tmp|race|swp|bak)/ nocase
        $dest = /--(dest|destination|target)/ nocase
    condition:
        $rsync and $symlink_short and ($loop_for or $loop_while) and 2 of ($unlink, $rename, $symlink_force, $tmp, $dest) and filesize < 1MB
}

Suricata IDS Rule

# NOTE: CVE-2026-53796 is a LOCAL TOCTOU race in the rsync NON-DAEMON receiver.
# Network-based detection is of limited value; this rule provides broad rsync
# protocol telemetry (banner and version negotiation) that can be correlated
# with host-level audit events when a local race is suspected.

alert tcp any any -> any 873 ( \
  msg:"CVE-2026-53796 Correlated Detection - Rsync Protocol Banner Observed (telemetry only)"; \
  flow:to_client,established; \
  content:"@RSYNC"; depth:8; \
  app-layer-protocol:rsync; \
  classtype:attempted-user; \
  reference:cve,2026-53796; \
  sid:202653796; rev:1; \
)

Elastic Detection

/*
   EQL correlation: symlink/rename filesystem activity in a shared directory
   followed by an rsync client process writing to a related path.
   Requires Elastic Endpoint (or auditbeat) file + process telemetry.
*/
sequence by host.name with maxspan=30s
  [ file where event.category == "file" and
      event.action in ("creation", "rename") and
      file.Ext.symlink_target != null and
      (file.path : "/tmp/*" or file.path : "/var/tmp/*" or file.path : "/dev/shm/*")
  ]
  [ process where process.name == "rsync" and
      process.args : ("/tmp/*", "/var/tmp/*", "/dev/shm/*") and
      not process.args : ("--daemon")
  ]

Splunk SPL Query

index=linux sourcetype=linux_audit
  (syscall="symlink" OR syscall="symlinkat" OR syscall="rename" OR syscall="unlink")
| bin _time span=30s
| stats dc(pid) as fs_mut_pids, values(cwd) as mutated_cwd, values(key) as audit_key by host, _time
| join type=inner host _time [
    search index=linux sourcetype=linux_audit syscall="execve" comm="rsync"
    | bin _time span=30s
    | stats dc(pid) as rsync_pids, values(argc) as rsync_args by host, _time
  ]
| where fs_mut_pids > 0 and rsync_pids > 0
| table _time, host, mutated_cwd, audit_key, rsync_args
| sort - _time

Wazuh OSSEC Rule

<!--
  Wazuh rule for CVE-2026-53796 context.
  Fires on repeated symlink/link syscalls in auditd telemetry with elevated
  frequency, which is consistent with an attacker racing an rsync receiver.
-->
<group name="audit,rsync,">
  <rule id="100537" level="10" frequency="8" timeframe="60">
    <if_sid>80700</if_sid>
    <field name="audit.data.syscall" type="osregex">(symlink|symlinkat|rename)</field>
    <field name="audit.data.a0" type="osregex">(tmp|shm)</field>
    <description>CVE-2026-53796: High-frequency symlink/rename syscalls in shared directories - possible rsync destination race</description>
    <group>rsync,toctou,cwe-59,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED). A single source (OSV) claims that a patch exists, but this has not been independently confirmed, and the OSV package entry still shows an unfixed state (0→unfixed). Until the upstream rsync project (rsync.samba.org / rsync 3.5.0 release) publishes an official advisory and release notes, treat the patch as unverified.

1) Immediate mitigations (before patching):

• Ensure rsync destination directories are not nested beneath world-writable or attacker-accessible parent directories. Use dedicated, root- or owner-only directories with mode 0700 (or 0750 with a controlled group) for all automated rsync client jobs.
• Review all cron jobs, systemd timers, CI pipelines, and backup scripts that invoke rsync in client (non-daemon) mode; if their destination paths reside under /tmp, /var/tmp, /dev/shm, or shared workspace directories, change the destinations to protected paths.
• Apply filesystem hardening to sync destinations: use immutable flags on parent directories (e.g., chattr +i) where feasible, or place destinations on mounts with restrictive ACLs.
• Avoid running rsync client jobs with elevated (root) privileges when destination parent directories are in shared locations. Run them as a dedicated, least-privilege service account.
• On multi-user hosts, restrict filesystem mutation in shared directories through sticky-bit configurations and discretionary access controls (note that sticky bits alone do not fully mitigate the parent-directory symlink race if the attacker owns the parent component).

2) Patch/upgrade steps:

• Monitor the official rsync project for the 3.5.0 release and corresponding advisory. Upgrade all systems running rsync client (non-daemon) mode to 3.5.0 or later once the fix is independently confirmed.
• After upgrading, verify the installed version (rsync --version) on every affected host — including containers, build agents, and backup servers — since rsync is frequently bundled with operating systems and tooling.
• Since patch confidence is low, re-verify the CVE status against OSV and NVD prior to declaring the environment remediated.

3) Long-term hardening:

• Enforce a vulnerability-management policy that tracks rsync versions across the fleet; rsync is a common transitive dependency and is easy to overlook.
• Instrument host-level auditing (auditd / Sysmon-equivalent) on symlink, rename, and unlink syscalls in shared directories so that race-condition primitives are visible to the SOC.
• For security-sensitive sync workflows, prefer rsync daemon mode with a configured chroot-like path confinement and read-only receiver configurations, or use alternative transfer tools with stricter path handling.
• Adopt least-privilege service accounts and limit local interactive access on hosts that process sensitive sync operations.

References

1. NVD Entry — CVE-2026-53796: https://nvd.nist.gov/vuln/detail/CVE-2026-53796
2. MITRE CVE Record — CVE-2026-53796: https://www.cve.org/CVERecord?id=CVE-2026-53796
3. OSV Advisory (patch source, single-source claim): https://osv.dev/vulnerability/CVE-2026-53796
4. rsync Official Project (release/version verification): https://rsync.samba.org/

Threat-actor campaigns / exploit-in-the-wild evidence: None reported. CVE-2026-53796 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code, Nuclei template, or confirmed in-the-wild exploitation is known at the time of writing. The EPSS percentile (0.7%) corroborates a very low near-term exploitation likelihood.