CVE-2026-53798

Executive Summary

CVE-2026-53798 is a privilege confusion vulnerability in rsync versions before 3.5.0, located in the name-converter subprocess that performs UID/GID name resolution during file transfers. A local attacker who can influence name-converter responses to return empty values can cause rsync to interpret those failures as successful resolutions to UID/GID 0 (root), resulting in transferred files being assigned root ownership when the name-converter also signals fake super-user status. The vulnerability carries a CVSS base score of 5.3 (medium severity) with a network attack vector and low integrity impact; no public exploit, Nuclei template, or CISA KEV listing has been identified at the time of writing.

Technical Analysis

rsync commonly preserves file ownership metadata when synchronizing data between hosts. When source and destination file owners are expressed as names rather than numeric IDs, rsync invokes a helper process referred to in the advisory as the "name-converter subprocess". This subprocess performs UID/GID lookups — typically against the local user and group databases — and returns resolved numeric values to the main rsync process for application to transferred files.

The vulnerability is a privilege/type confusion flaw classified under CWE-704 (Incorrect Type Conversion or Cast). When the name-converter subprocess returns an empty response for a UID or GID lookup — which should be interpreted as a lookup failure (e.g., unknown user or group name) — rsync incorrectly coerces that empty value into the integer 0. In Unix/Linux semantics, UID/GID 0 is the root user/group. The second condition required for exploitation is a signal from the name-converter indicating "fake super-user status"; when both conditions align, rsync proceeds to assign root ownership to files it transfers, even though the requesting process may hold no such privilege.

The CWE-704 classification reflects the core mechanism: a failure sentinel (empty response) is cast or converted into a legitimate numeric identifier without validation. The advisory does not specify the exact IPC channel, request format, or data source manipulation technique that allows an attacker to influence the subprocess's output. Consequently, precise implementation details of the attack primitive are unavailable, and any description below the class level would be speculative.

Two additional observations are important for analysts:

1. The NVD description scopes the attacker as "local", but the official CVSS vector uses AV:N (network) with PR:N (no privileges required) and UI:N (no user interaction). This discrepancy suggests the name-converter influence may be achievable through a network-exposed rsync path — for example, daemon-mode transfers (TCP 873) where module configuration enables name-based UID/GID mapping. Security teams should not dismiss the vulnerability as local-only based on the prose description alone.

2. The EPSS score is 0.00278 (20.3rd percentile of exploited CVEs), indicating low current likelihood of exploitation in the wild. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-53798; the attack chain below is inferred from the vulnerability class described in the NVD entry.

1. Reconnaissance / target identification – An attacker first identifies an rsync deployment running a version prior to 3.5.0 that performs UID/GID name mapping during transfers. Candidates include multi-user systems running rsync daemons (TCP 873), backup servers, CI/CD pipelines, and scheduled synchronization jobs that preserve ownership metadata. Given the AV:N vector, network-reachable rsync endpoints should be treated as in-scope.

2. Triggering the flaw – The attacker influences the name-converter subprocess to return an empty response for a chosen UID or GID lookup. The advisory does not disclose the precise influence mechanism (e.g., manipulating the local user database, injecting malformed names into transfer arguments, or altering subprocess inputs). At the class level, the attacker needs to cause at least one lookup to fail with an empty result rather than an explicit error.

3. Payload / execution method – During an rsync transfer, the empty lookup response is misinterpreted as a successful resolution to UID/GID 0. If the name-converter simultaneously signals fake super-user status, rsync assigns root ownership to the files being transferred, regardless of the real privileges of the process performing the transfer.

4. Post-exploitation impact – Files written by the transferred data become owned by root. If the attacker controls the file contents and can place them where a root-privileged process will later act on them — for example, world-writable staging directories consumed by root-run scripts, cron jobs, or service managers — the attacker can plant root-owned configuration, scripts, or other artifacts. This can serve as a building block for privilege escalation or for corruption of ownership-based access control expectations in downstream automation.

Impact Assessment

• Confidentiality impact: None (C:N).
• Integrity impact: Low (I:L) — file ownership metadata is tampered with; no direct code execution or data disclosure.
• Availability impact: None (A:N).
• Attack conditions: AV:N / AC:L / PR:N / UI:N — network-reachable attack surface, low complexity, no privileges required, no user interaction, with a scope change to "unchanged" (S:U).
• Affected systems: All rsync deployments prior to 3.5.0 that utilize the name-converter subprocess for UID/GID mapping. This includes rsync daemons, backup infrastructure, container image and artifact synchronization pipelines, and workstation-to-server transfer workflows on multi-user systems.
• Blast radius: The flaw undermines trust in file ownership metadata, which is a foundational access-control primitive on Unix/Linux systems. While the direct impact is a single integrity violation, the downstream consequences depend entirely on what root-owned files the attacker can position and what later processes will read or execute them. The low EPSS percentile and absence of KEV listing indicate limited active exploitation, but the network scope of the CVSS vector warrants proactive patching.

Detection Guidance

Detection of this vulnerability is challenging because the malicious behavior manifests as a legitimate rsync transfer followed by root-owned files. The rules below are heuristic and monitor for the observable preconditions and outcomes of the flaw: rsync processes performing ownership changes, name-converter involvement, and connections to rsync daemon ports.

Sigma Rule

title: Rsync File Ownership Change to Root - Potential CVE-2026-53798
id: 5c3a1b1e-8d2a-4e7a-b3c4-aa8b2d4f6e10
status: experimental
description: >
  Detects rsync processes changing file ownership to UID/GID 0 (root)
  via fchownat/chown syscalls. This may indicate exploitation of
  CVE-2026-53798, where empty name-converter UID/GID lookup responses
  are misinterpreted as root ownership.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SYSCALL
    process.name: rsync
    syscall:
      - chown
      - fchownat
      - lchown
  condition: selection
fields:
  - uid
  - gid
  - a0
  - a1
  - exe
  - key
level: medium
tags:
  - attack.t1565.001
  - cve.2026.53798

YARA Rule

rule rsync_name_converter_cve_2026_53798 {
  meta:
    author = "Valtersit Threat Intelligence"
    description = "Detects scripts or binaries referencing rsync name-converter behavior and root ownership manipulation consistent with CVE-2026-53798"
    reference = "CVE-2026-53798"
    date = "2026-01-01"
  strings:
    $a = "name-converter" ascii wide nocase
    $b = "rsync" ascii wide nocase
    $c = "fake super" ascii wide nocase
    $d = "chown" ascii wide nocase
    $e = "uid" ascii wide nocase
    $f = "gid" ascii wide nocase
  condition:
    filesize < 1MB and $b and ($a or $c) and any of ($d, $e, $f)
}

Suricata IDS Rule

alert tcp any any -> any 873 ( \
  msg:"CVE-2026-53798 Potential Rsync Daemon Target - Name-Converter UID/GID Manipulation"; \
  flow:established,to_server; \
  content:"RSYNCD"; nocase; within:16; \
  metadata:created_at 2026_01_01, updated_at 2026_01_01; \
  reference:cve,2026-53798; \
  sid:2026053798; rev:1;)

Note: The rule fingerprints rsync daemon protocol negotiation on TCP 873. It is a situational-awareness rule for locating potentially affected endpoints; the vulnerable UID/GID mapping exchange itself is not visible in plaintext on the wire, and the rule does not confirm exploitation.

Elastic Detection

process where event.category == "process" and event.action == "exec"
  and process.name == "rsync"
  and process.args == "*name-converter*"

file where event.category == "file" and event.action in ("change-owner", "modify")
  and file.owner == "root" and file.group == "root"
  and process.name == "rsync"
  and file.path : ("/tmp/*", "/var/tmp/*", "/home/*", "/srv/*")

Splunk SPL Query

(index=linux_audit OR index=linux_sysmon) (process_name=rsync OR Image="*rsync*")
| where like(command_line, "%name-converter%") OR like(command_line, "%fake super%")
| table _time host user process_name command_line parent_process_name
| sort - _time

index=linux_audit (syscall=chown OR syscall=fchownat OR syscall=lchown) process_name=rsync
| eval uid_zero = mvfilter(match(a1, "0"))
| where isnotnull(uid_zero)
| stats count min(_time) max(_time) by host user process_name a0 a1

Wazuh OSSEC Rule

<group name="auditd,rsync,">
  <rule id="100537" level="10" frequency="3" timeframe="60">
    <if_sid>80700</if_sid>
    <match>rsync</match>
    <regex>chown|fchownat|lchown</regex>
    <description>CVE-2026-53798: rsync process changed file ownership to UID/GID 0</description>
    <group>rsync,auditd,gdpr_IV_35.7.d,pci_dss_11.4</group>
    <mitre>
      <id>T1565.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for CVE-2026-53798 is 2/4 (CLAIMED): a single source (OSV) claims a fix, but it has not been independently confirmed, and the OSV package entry currently shows an unfixed state (0→unfixed). No official vendor workaround has been published.

1. Immediate mitigations

   • Restrict network access to rsync daemon port 873 with host-based and network firewalls; treat rsync daemons as a sensitive service and allow only trusted transfer peers.
   • Disable UID/GID name-based mapping in rsync configurations where numeric ID preservation suffices, eliminating use of the vulnerable name-converter subprocess.
   • Run rsync transfers from dedicated, unprivileged service accounts in minimal chroot/container environments.
   • Audit and restrict which local users can influence user/group name resolution data sources on rsync hosts.
   • Monitor for chown-to-root events generated by rsync processes (see detection rules above).

2. Patch / upgrade steps

   • Upgrade to rsync 3.5.0 or later once the patched release is confirmed available from your operating system vendor or the upstream project. Verify the fix independently before deploying into production, given the single-source patch claim.
   • Test the upgrade against backup and synchronization workflows that rely on ownership preservation to avoid regression.

3. Long-term hardening

   • Apply the principle of least privilege to all rsync service accounts and daemon module configurations.
   • Isolate backup and artifact-sync infrastructure from multi-user systems where untrusted local users exist.
   • Subscribe to NVD, OSV, and vendor security feeds for rsync to track patch confirmation and any subsequent CISA KEV or EPSS changes.
   • Periodically re-evaluate this CVE as public exploit activity may emerge after disclosure.

References

1. NVD – CVE-2026-53798: https://nvd.nist.gov/vuln/detail/CVE-2026-53798
2. OSV – CVE-2026-53798: https://osv.dev/vulnerability/CVE-2026-53798
3. CVE Record – CVE-2026-53798: https://www.cve.org/CVERecord?id=CVE-2026-53798
4. rsync project homepage: https://rsync.samba.org/
5. CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-53798 is NOT listed as of this report.

No known threat-actor campaigns or exploit-in-the-wild evidence has been identified for CVE-2026-53798 at the time of writing. EPSS score 0.00278 (20.3rd percentile) indicates low active exploitation likelihood.