CVE-2026-53799

Executive Summary

CVE-2026-53799 is a local symlink race condition (CWE-59, TOCTOU) affecting rsync versions prior to 3.5.0. A low-privileged local attacker can substitute a symlink at a predictable destination path between rsync's file write and the subsequent acl_set_file() or lsetxattr() call, redirecting ACL and extended attribute application to arbitrary files outside the intended destination tree. If an affected rsync process runs with elevated privileges (e.g., root-owned backup or synchronization jobs), successful exploitation can result in arbitrary ACL/xattr modification of sensitive files and local privilege escalation. The vulnerability has a CVSS score of 6.3, is not listed in CISA KEV, and no public exploit code is currently known.

Technical Analysis

rsync is widely used for file replication, backup, and content synchronization. During a transfer that preserves POSIX ACLs or extended attributes, rsync first writes file content to a destination path and then applies metadata by invoking acl_set_file() for ACLs and lsetxattr() for extended attributes. Because metadata application occurs as a separate operation after the file write, a time-of-check-to-time-of-use (TOCTOU) race window exists between the two operations.

The NVD description states that the vulnerability allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files "by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call." In practical terms:

1. A privileged rsync process (or any rsync process writing to a path an attacker can influence) creates or overwrites a file at a destination path.
2. Before rsync applies the ACL/xattr, the attacker replaces that destination entry with a symlink pointing to a file of their choosing — typically a file outside the intended destination tree.
3. When rsync invokes acl_set_file() or lsetxattr() on the destination path, the kernel resolves the symlink and applies the ACL or extended attribute to the symlink target instead.

This flaw falls squarely under CWE-59 (Improper Link Resolution Before File Access — "link following"). The attacker must be able to predict the destination path and win the timing race, which explains the CVSS vector's high attack complexity (AC:H). Access requirements are local (AV:L) and require only low privileges (PR:L) — the attacker needs an account on the system, not root. No user interaction is required (UI:N), and the impact is scope-unchanged (S:U).

The impact mechanism is straightforward: applying a permissive ACL to a target file grants the attacker read or write access to that file, even if the target is owned by another user or by root. Extended attributes can be equally damaging depending on the filesystem — for example, attributes in the security.* namespace can interact with file capabilities on Linux. By planting a symlink in a location where rsync will soon write and apply metadata, an attacker can effectively transform rsync's legitimate metadata-preservation work into an arbitrary ACL/xattr write primitive.

The affected version window is all rsync releases before 3.5.0. The OSV package entry lists the package as unfixed at the time of reporting, but the NVD description establishes 3.5.0 as the fixed boundary. Patch confidence is 2/4 (CLAIMED) — only a single source (OSV) asserts that a patch exists, and this has not been independently confirmed. No vendor-supplied technical detail, commit hash, or advisory text was provided, so the exact code-level fix cannot be characterized here.

Exploitation Scenarios

No public PoC exists, and no exploit code is available; the following attack chain is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker, holding a low-privileged local account, enumerates the environment for rsync jobs that run with elevated privileges and preserve ACLs or extended attributes — for example, cron jobs, systemd timers, or administrator-initiated backup and mirroring operations. The attacker identifies a predictable destination path where a privileged rsync process writes files and subsequently applies ACL/xattr metadata.

2. Triggering the flaw. The attacker prepares a symlink pointing to a target file they wish to modify — any file that the rsync process has permission to modify. As rsync writes a file to the predictable destination path, the attacker repeatedly replaces the just-written file (or races the path resolution) with the crafted symlink in the window between the write and the acl_set_file() / lsetxattr() call.

3. Execution method (vulnerability-class level). The race is won when rsync's metadata-application call resolves the attacker's symlink instead of the actual written file. The kernel follows the symlink and applies the ACL or extended attribute to the target file outside the intended destination tree. This is a classic link-following / TOCTOU primitive — no application-level payload is involved; the "payload" is the symlink itself plus the attacker-chosen ACL/xattr values that rsync is told to apply.

4. Post-exploitation impact. The target file now carries an attacker-controlled ACL (potentially granting the attacker read/write access) or an attacker-controlled extended attribute. Depending on which file is targeted, this can enable credential disclosure, modification of security-sensitive configuration, or local privilege escalation — for example, by granting write access to a system file that subsequently yields code execution with elevated privileges.

Impact Assessment

The CVSS score of 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a locally exploitable race condition that yields high confidentiality and high integrity impact with no availability impact. The high attack complexity reflects the difficulty of reliably winning the TOCTOU race; nevertheless, race conditions of this class are routinely weaponized, and the low privilege requirement (PR:L) means any unprivileged local user is a potential threat actor.

Business impact depends on where rsync is deployed. Common high-value targets include:

• Backup infrastructure where rsync runs as root or with broad filesystem privileges.
• CI/CD and deployment pipelines that synchronize application directories and preserve ACLs/xattrs.
• Shared hosting and multi-tenant environments where local users coexist with privileged synchronization jobs.

Because the race target is any file the rsync process can modify, the blast radius is host-local (scope is unchanged per the CVSS vector), but a successful exploit converts a low-privileged local account into an arbitrary ACL/xattr write primitive with high integrity impact. If extended attributes in privileged namespaces are targeted, the chain can end in full local privilege escalation and, on a compromised host, potentially pivot to adjacent systems via stolen credentials. The EPSS score is 0.00091 (0.6th percentile of exploited CVEs), indicating that mass exploitation is not currently expected; however, the vulnerability class is well understood by penetration testers, and weaponization cannot be ruled out once rsync 3.5.0 details are broadly analyzed.

Detection Guidance

Detection of CVE-2026-53799 is challenging because the vulnerability is a local filesystem race rather than a network protocol flaw. The most reliable detection signals are endpoint-level: symbolic link creation events occurring in close temporal proximity to rsync executions, and ACL/xattr operations performed by rsync processes on unexpected paths. The rules below are intended to surface those indicators. Network rules have limited value for this CVE and are primarily useful for inventorying exposed rsync daemons that extend the attack surface.

Sigma Rule

title: Potential CVE-2026-53799 Exploitation via rsync Symlink Race
id: 5729f0e4-8f2e-4b1a-9d3c-6c8f9a2b1d7e
status: experimental
description: Detects symbolic link creation in close temporal proximity to rsync execution, which may indicate an attempt to exploit the CVE-2026-53799 symlink race condition in acl_set_file() or lsetxattr() calls.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53799
author: Valtersit Threat Intelligence
date: 2026/05/15
logsource:
    product: linux
    service: auditd
detection:
    selection_rsync:
        type: EXECVE
        a0|contains: rsync
    selection_symlink:
        type: SYSCALL
        syscall:
            - symlink
            - symlinkat
    condition: selection_rsync and selection_symlink
falsepositives:
    - Legitimate backup or deployment scripts that create symlinks and invoke rsync in the same session
level: medium
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2026.53799

YARA Rule

rule CVE_2026_53799_rsync_symlink_race
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-05-15"
        description = "Detects scripts or binaries referencing patterns consistent with CVE-2026-53799 exploitation: rsync combined with symlink creation and ACL/xattr manipulation."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-53799"
        cve = "CVE-2026-53799"
        os = "linux"
    strings:
        $rsync = "rsync" ascii nocase
        $ln = "ln -s" ascii nocase
        $symlink = "symlink" ascii nocase
        $setfacl = "setfacl" ascii nocase
        $acl = "acl_set_file" ascii
        $xattr = "lsetxattr" ascii
        $xattr2 = "setxattr" ascii nocase
    condition:
        $rsync and 2 of ($ln, $symlink, $setfacl, $acl, $xattr, $xattr2)
}

Suricata IDS Rule

alert tcp any any -> any 873 (msg:"CVE-2026-53799 - rsync Service Exposure (symlink race condition target)"; flow:established; content:"RSYNCD"; nocase; reference:cve,2026-53799; classtype:attempted-admin; sid:202653799; rev:1;)

Note: This rule is for attack-surface inventory rather than direct race detection. The vulnerability itself is local and does not produce a distinct network signature; however, exposed rsync daemons (port 873/tcp, RSYNCD banner) broaden the population of systems on which a local attacker can perform reconnaissance and should be reviewed.

Elastic Detection

sequence by host.id with maxspan=10s
  [ file where event.module == "auditd" and event.action in ("created", "updated") and process.name == "rsync" ]
  [ file where event.module == "auditd" and event.action == "symbolic_link" ]

This sequence correlates rsync file-write activity with a subsequently created symbolic link on the same host within a 10-second window. The short maxspan reduces noise while covering the race window described in the vulnerability. Expected false positives include legitimate scripts that create symlinks into directories being synchronized.

Splunk SPL Query

index=linux sourcetype=linux_audit
| search "comm=rsync" OR "syscall=symlink" OR "syscall=symlinkat"
| transaction host user maxspan=10s
| eval exploit_signal = if(match(_raw, "symlink") AND match(_raw, "rsync"), "RACE_INDICATOR", "monitor")
| where exploit_signal == "RACE_INDICATOR"
| table _time, host, user, exploit_signal, _raw
| sort - _time

Wazuh OSSEC Rule

<group name="cve_2026_53799,">
    <rule id="470085" level="12">
        <decoded_as>auditd</decoded_as>
        <field name="syscall">symlink</field>
        <description>CVE-2026-53799: symbolic link creation detected - possible symlink race primitive against rsync</description>
        <group>privilege_escalation,</group>
        <options>no_full_log</options>
    </rule>

    <rule id="470086" level="12">
        <if_sid>1005371</if_sid>
        <field name="comm">rsync</field>
        <description>CVE-2026-53799: rsync process observed near symbolic link creation - possible TOCTOU exploitation</description>
        <group>privilege_escalation,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (OSV) claims that a patch exists; this is not independently confirmed. The NVD description establishes rsync 3.5.0 as the fixed boundary, and the affected version window is all releases before 3.5.0.

1. Immediate mitigations:

   • Upgrade to rsync 3.5.0 as soon as it is validated in your environment. Given the low patch confidence, verify the vendor's release notes and changelog before production deployment.
   • Where an upgrade is not immediately possible, disable the application of ACLs and extended attributes in rsync jobs where those features are not operationally required. This eliminates the vulnerable code path.
   • Ensure destination directories of privileged rsync jobs are not writable or predictable by unprivileged local users. Restrict write access to the directories where rsync lands files.
   • Run rsync jobs with the least privilege required; avoid executing backups and synchronization as root when a dedicated service account will suffice.
   • Monitor for the detection signals above (symlink creation near rsync activity) on any host running rsync before 3.5.0.

2. Patch/upgrade steps:

   • Test rsync 3.5.0 in a staging environment that exercises the same ACL/xattr preservation workflows used in production.
   • Roll out the upgrade to all affected Linux/Unix hosts, prioritizing systems where rsync runs with elevated privileges.
   • After patching, confirm that the fixed version reports correctly and that ACL/xattr preservation workflows continue to function as expected.

3. Long-term hardening:

   • Apply the principle of least privilege to all synchronization, backup, and deployment pipelines.
   • Prefer filesystem APIs that are immune to symlink races where feasible (e.g., operations using open file descriptors or O_NOFOLLOW semantics) in any custom tooling that wraps rsync.
   • Incorporate rsync releases into your vulnerability management and patch-cycle tracking so that future fixes of this class are deployed rapidly.
   • Review all internet-facing rsync daemons; disable them if not required, or restrict them via firewall rules and module-level access controls.

References

1. NVD Entry — CVE-2026-53799: https://nvd.nist.gov/vuln/detail/CVE-2026-53799
2. OSV Vulnerability Record — CVE-2026-53799: https://osv.dev/vulnerability/CVE-2026-53799
3. MITRE CVE Record — CVE-2026-53799: https://www.cve.org/CVERecord?id=CVE-2026-53799
4. CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No vendor advisory, researcher blog, or additional patch source was supplied in the input data. No threat actor campaigns or exploit-in-the-wild evidence are known at the time of writing; CISA KEV does not include this CVE, and no public PoC or exploit code is available.