CVE-2026-53797

Executive Summary

CVE-2026-53797 is a symlink race condition in rsync versions prior to 3.5.0, specifically in the sender's source-tree traversal logic. A local attacker with the ability to manipulate a parent directory of the rsync source tree can redirect file reads to arbitrary paths outside the intended transfer root, leading to disclosure of sensitive file contents. The vulnerability has a CVSS base score of 4.7, requires low privileges but high attack complexity, and is currently not known to be exploited in the wild.

Technical Analysis

The vulnerability is caused by a Time-of-Check to Time-of-Use (TOCTOU) condition in the rsync sender's traversal of the source tree. When rsync copies or transfers a directory tree, it must resolve each path component before opening and reading files. If an attacker can change a parent directory component of the source tree — for example, by atomically replacing that directory with a symlink — after path resolution but before the file open operation, the rsync process can be tricked into reading files whose actual location is outside the configured source root.

The flaw maps to CWE-59: Improper Link Resolution Before File Access, commonly referred to as a "link following" vulnerability. The race window is between the sender's resolution of a directory path and the subsequent file open operation. This is not a network-exposed vulnerability; it is a local file-system race. The attacker must normally have the ability to modify directory entries in a parent path of the target source tree. The impact is limited to confidentiality: no integrity or availability impact is specified. The attacker does not need user interaction, but does require local access and must win a narrowly timed race condition, which explains the high Attack Complexity (AC:H) in the CVSS vector.

No code-level details, such as specific function names, call sites, or patches, are included in the provided NVD description. The technical understanding is therefore derived from the vulnerability class and the description text. The affected version boundary is explicitly provided: rsync before 3.5.0. Patch confirmation is incomplete — the only reference is an OSV entry claiming a fix in 3.5.0, but this has not been independently verified.

Exploitation Scenarios

Because no public PoC or exploit code is available, the following attack chain is inferred from the vulnerability class and NVD description.

1. Reconnaissance / target identification: A local unprivileged attacker identifies a scheduled or manually triggered rsync job that copies a directory tree whose parent path is writable or otherwise manipulable by the attacker. For example, an administrator or backup job may invoke rsync on a directory nested below a location where a lower-privileged user can rename or replace directories.

2. Triggering the race: After the rsync sender begins traversing the source tree, the attacker atomically replaces a parent directory component with a symlink that points outside the source root. The replacement must occur between the moment rsync resolves the path and the moment it opens the file. Because the operation is atomic, the rsync sender sees a valid directory entry during path resolution and then follows the symlink at file-open time.

3. Payload / execution method: No malicious code execution in the rsync process is required. The attacker manipulates the file-system namespace itself. The redirected path causes the rsync sender to open and read files that were never part of the intended source tree. The contents are then transferred according to the rsync job's normal behavior — for example, to a remote rsync receiver or to a local destination controlled by the attacker.

4. Post-exploitation impact: The attacker obtains the contents of sensitive files that the rsync process can read. The exact disclosure set depends on the privileges under which rsync runs. If rsync is executed by a root or service account, the effective impact can include system configuration, credentials, or other confidential data. Because the issue is a local race condition, exploitation is not trivial; however, it can be repeated with automation and file-system event monitoring to improve reliability.

Impact Assessment

The vulnerability is a local confidentiality issue. The CVSS vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. The base score is 4.7. The low privilege requirement (PR:L) is significant: ordinary local users may qualify if they can manipulate the directory structure containing an rsync source tree. The high attack complexity (AC:H) reflects the difficulty of reliably winning the race. The scope is unchanged, meaning the compromised component and the impacted component are the rsync process and its own read privileges.

The primary business impact is unauthorized disclosure of files outside the intended transfer root. This could affect backup systems, CI/CD pipelines, file-synchronization services, or any administrative automation that invokes rsync on directory trees with attacker-influenced parent paths. The EPSS score is very low (0.00092, 0.6 percentile), and the CISA KEV catalog does not list this CVE. There is no public evidence of exploitation in the wild as of this report.

Detection Guidance

Because CVE-2026-53797 is a local TOCTOU symlink race, network detections are not reliable for confirming exploitation. The rules below model supporting behaviors — rsync execution, symlink and rename operations, and unusual source paths — and should be tuned to local environments.

Sigma Rule

title: Suspicious Symlink or Rename Activity Near rsync Execution
id: 0c9db5b2-5379-4c01-9d61-1f3b6f21ac33
status: experimental
description: Detects symlink or rename operations in close temporal proximity to rsync process execution, potentially indicating CVE-2026-53797 exploitation attempts.
logsource:
  product: linux
  service: auditd
detection:
  selection_rsync:
    type: SYSCALL
    comm: rsync
  selection_symlink_ops:
    syscall:
      - 83        # symlink
      - 258       # renameat
      - 316       # renameat2
  condition: selection_rsync and selection_symlink_ops
  timeframe: 10s
falsepositives:
  - Legitimate administrative operations that create symlinks during backup jobs
  - File-system renames performed by automation near rsync transfers
level: medium
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-53797

YARA Rule

rule rsync_symlink_race_tooling_heuristic
{
    meta:
        author = "Threat Intelligence Team"
        description = "Heuristic detection of scripts or binaries containing rsync and symlink/rename primitives potentially used for CVE-2026-53797"
        cve = "2026-53797"
    strings:
        $rsync = "rsync" ascii wide nocase
        $symlink = "symlink" ascii wide nocase
        $rename = "rename" ascii wide nocase
        $readlink = "readlink" ascii wide nocase
    condition:
        $rsync and (2 of ($symlink, $rename, $readlink)) and filesize < 5MB
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 873 (msg:"ET TROJAN Possible Rsync Symlink Race Exploitation - CVE-2026-53797"; flow:established,to_server; content:"rsync"; nocase; pcre:"/\.\.\/|symlink|rename/"; classtype:attempted-user; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-53797; sid:2026537; rev:1;)

Elastic Detection

sequence by host.id with maxspan=15s
  [ file where event.category == "file" and event.action in ("creation", "rename", "change") and process.name != null and process.name != "rsync" ]
  [ process where event.category == "process" and event.type == "start" and process.name == "rsync" ]

Splunk SPL Query

index=linux sourcetype=linux_audit (syscall=symlink OR syscall=renameat OR syscall=renameat2)
| transaction host maxspan=10s startswith=link_change endswith=rsync_run
| search comm=rsync OR command=rsync
| table _time host user exe cwd key

Wazuh OSSEC Rule

<group name="rsync,">
  <rule id="100537" level="10">
    <if_sid>550</if_sid>
    <command>rsync</command>
    <field name="audit.type">SYSCALL</field>
    <field name="audit.syscall">83|258|316</field>
    <description>Possible CVE-2026-53797 rsync symlink race activity</description>
    <group>rsync,trojan,</group>
  </rule>
</group>

Mitigation & Patch Guidance

The patch confidence for CVE-2026-53797 is 2/4 — the patched version is claimed but not independently confirmed.

Immediate mitigations:

• Run rsync with the least privilege necessary; do not run backup or synchronization jobs as root unless required.
• Ensure that parent directories of rsync source trees are not writable by unprivileged local users.
• Where possible, place source trees under root-owned directories with restrictive permissions.
• Use dedicated service accounts and avoid reusing administrative accounts for automated rsync jobs.
• Monitor file-system audit logs for unexpected symlink or rename operations near scheduled rsync tasks.

Patch / upgrade steps:

• Upgrade to rsync 3.5.0 or later if the distribution provides it.
• Validate that the package is delivered from an official source and is signed by the vendor.
• Because the patch is not independently confirmed, test the updated rsync binary in a staging environment before production deployment.
• Monitor the OSV advisory channel for additional verification or updated fix information.

Long-term hardening:

• Enable file-system auditing (e.g., auditd) on hosts that run rsync-based backup or file-distribution tasks.
• Enforce immutable or read-only permissions on critical source directories when possible.
• Review automation scripts for use of predictable source directories under user-writable paths.
• Incorporate the relevant package upgrade into standard configuration-management baselines.
• Maintain awareness of future advisories from the rsync project and Linux distribution vendors.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-53797
• https://osv.dev/vulnerability/CVE-2026-53797
• https://www.cve.org/CVERecord?id=CVE-2026-53797
• https://rsync.samba.org/

No known threat-actor campaigns or exploit-in-the-wild evidence is currently available for CVE-2026-53797.