CVE-2026-53801

Executive Summary

CVE-2026-53801 is a symlink race condition (CWE-59, "Improper Link Resolution Before File Access — 'Link Following'") in rsync versions prior to 3.5.0. The flaw resides in the sender's directory scanning logic, where a time-of-check-to-time-of-use (TOCTOU) window between the lstat() call and the subsequent opendir() call allows an attacker who can create or manipulate symlinks in a scanned path to redirect enumeration outside the configured module root. Successful exploitation results in unauthorized disclosure of files from both daemon-mode and non-daemon sender-side rsync operations. The vulnerability carries a CVSS score of 5.9 (high confidentiality impact; no integrity or availability impact) and currently has no confirmed public exploit, no CISA KEV listing, and a low EPSS percentile, indicating low near-term mass exploitation probability.

Technical Analysis

The vulnerability is rooted in a classic time-of-check-to-time-of-use (TOCTOU) race condition, categorized under CWE-59. The NVD description identifies the affected component as the sender's directory scanning logic in rsync. When rsync operates as a sender — either as a network-facing daemon (rsyncd) or in a non-daemon mode such as an SSH-invoked sender process — it traverses the directory tree under the configured module root in order to enumerate files for transfer or listing.

The scanning routine evaluates each path component with an lstat() call to determine the file type (e.g., regular file, directory, symlink). If the path component is determined to be a directory, the logic subsequently issues an opendir() call to enumerate its contents. The race condition exists in the interval between these two system calls. If an attacker can replace or manipulate a symlink — or swap a symlink for a directory entry — in that interval, the path component resolves differently at opendir() time than it did at lstat() time. The attacker-controlled replacement may point outside the module root's intended subtree, causing the sender to enumerate and transfer files that should never have been visible to that rsync operation.

The attack surface consists of any rsync deployment where an attacker has the ability to create or manipulate symlinks in a path component of the scanned tree. This includes:

• Daemon-mode rsync (TCP/873): An authenticated or anonymous rsync daemon that provides read access to a module or modules. If a module contains a directory writable by a low-privileged user, that user could plant malicious symlinks ahead of the scan and race for the lstat()/opendir() window whenever the sender enumerates.
• Non-daemon sender-side scanning: rsync invoked over SSH where the sending side is the server-side process (the "sender"). This is common in automated backup pipelines, content mirroring, and deployment tools. Any writable directory in the scanned tree (e.g., a shared upload directory) could be leveraged by the attacker to influence the sender's enumeration.

The attack mechanism is a data confidentiality breach rather than a integrity or availability breach: the sender does not modify files, but it can be forced to disclose file listings and file contents from outside the module root. Since the sender process typically runs with the privileges of the rsync service account, the file disclosure is bounded by those privileges — but the unintended subtree may include configuration files, credentials, backup data, or application source that exists outside the designated module root.

The NVD description provides insufficient implementation detail to identify the exact code location, patch commit, or fixed function names. The availability of a fix is claimed by OSV (rsync 3.5.0) but is not independently confirmed; patch confidence is rated 2/4.

Exploitation Scenarios

No public proof-of-concept is known for this CVE, and no exploit code has been disclosed. The attack chain below is therefore inferred from the vulnerability class (symlink race condition during directory traversal) as described in the NVD entry.

Step 1 — Reconnaissance / Target Identification. An attacker identifies an exposed rsync daemon via Internet-wide scanning (e.g., Shodan query port:873 or product:rsync) or identifies an internal rsync-over-SSH sender used in backup or file-distribution workflows. The attacker probes the daemon's module list and checks for directories within a module that are writable by unprivileged users (e.g., anonymous upload directories, shared drop-folders, a module exposing /tmp or a web-accessible upload path).

Step 2 — Triggering the Specific Flaw Class. The attacker plants a symlink in a path component that the sender will traverse during its next directory scan. The symlink chain or a following path component is engineered so that, after the attacker's manipulation, it can resolve to a directory outside the module root. The attacker then rapidly replaces the symlink with a directory entry (or vice versa) to win the race against the sender's scanning logic. Because the window is between the lstat() call (which evaluates the previous state) and the subsequent opendir() call (which opens the new state), a successful race means the sender opens a directory that was not the one it validated.

Step 3 — Payload / Execution Method at the Vulnerability-Class Level. The attacker causes the sender to enumerate the attacker-selected directory outside the module root. In daemon-mode, the attacker initiates reads of the module via the rsync protocol; the sender's compromised enumeration returns file lists and, on transfer, file contents from the out-of-root directory. In non-daemon mode, the attacker may be the client requesting a transfer of a path that lives under the intended module root, but the raced symlink redirects the sender's enumeration to an arbitrary directory on the filesystem. No code execution is involved — the "payload" is the unauthorized read of filesystem metadata and file data.

Step 4 — Post-Exploitation Impact. The attacker collects sensitive data: system configuration files, private keys, database dumps, credentials stored in backup trees, or application secrets. In backup infrastructure, whole backup repositories outside the module root may be disclosed. Disclosed credentials or application data may subsequently be leveraged for lateral movement or privilege escalation within the enterprise, effectively turning a confidentiality breach into an initial-access enabler.

Impact Assessment

The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (score 5.9) reflects a network-exploitable, high-complexity attack with no privileges required and no user interaction. The sole impact is high confidentiality loss; integrity and availability are unaffected. The high attack complexity stems from the race condition, which typically requires repeated attempts and favorable timing.

The business impact is concentrated in organizations relying on rsync for:

• Backup and disaster-recovery pipelines (daemon-mode and SSH-based), where the module root may sit alongside more sensitive data on the same filesystem.
• Public or semi-public file mirrors where upload directories are writable by lower-trust users, giving those users a local position from which to race the sender.
• Content deployment and artifact distribution where rsync-over-SSH is used with a sender-side account that has broader filesystem visibility than the module root implies.

The EPSS score of 0.00286 (21.1 percentile of exploited CVEs) and the absence of the CVE from the CISA Known Exploited Vulnerabilities list indicate that, at the time of writing, there is no evidence of exploitation in the wild. Threat actor campaigns leveraging this CVE have not been observed. Nevertheless, rsync installations are high-value targets because they sit at the boundary between network-facing services and sensitive stored data; the flaw should be treated seriously even absent active exploitation.

Detection Guidance

The following detection content is heuristic and targets the vulnerability class (symlink race during rsync directory scanning), the corresponding reconnaissance patterns against rsync daemons, and suspicious sender-side process behavior. Because no public PoC exists, these rules are not tuned against real exploit traffic and should be validated in a lab environment before deployment.

Sigma Rule

title: Suspicious rsync Sender Invocation with Path Traversal or Symlink-Following Options
id: 4f9d7c2b-6a10-4de8-9b32-7c6e8d1f0a55
status: experimental
description: >
  Detects rsync process invocations that combine the rsync binary with command-line
  arguments consistent with path traversal, symlink-following behavior, or absolute
  path targets outside an intended module root. Correlates with CVE-2026-53801
  sender-side symlink race activity.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53801
author: Threat Intelligence Team
date: 2026/05/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_rsync:
    Image|endswith:
      - '/rsync'
      - '/rsyncd'
  selection_suspicious:
    CommandLine|contains:
      - '../'
      - '/../../'
      - '--copy-links'
      - '--no-relative'
      - '-L'
      - '--absolute-names'
  condition: selection_rsync and selection_suspicious
falsepositives:
  - Legitimate administrative usage of rsync to mirror symlink trees
  - Automated deployment scripts that intentionally sync files outside a standard root
level: medium
tags:
  - attack.t1190
  - cve.2026-53801
  - cwe.59

YARA Rule

rule CVE_2026_53801_rsync_symlink_race_tooling
{
    meta:
        author = "Threat Intelligence Team"
        description = "Detects script or binary tooling that strings together rsync, lstat, opendir, and symlink-race primitives consistent with CVE-2026-53801 exploit attempts"
        date = "2026-05-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-53801"
        cve = "2026-53801"
        score = 60

    strings:
        $a = "rsync" ascii nocase
        $b = "symlink" ascii nocase
        $c = "lstat" ascii nocase
        $d = "opendir" ascii nocase
        $e = "module root" ascii nocase
        $f = "out of root" ascii nocase
        $g = "race" ascii nocase
        $h = "readlink" ascii nocase

    condition:
        uint16(0) == 0x5a23  // "MZ" (PE) or 0x7f454c46 (ELF) omitted for generic scripts
        and 2 of ($a, $b, $c, $d, $e, $f, $g, $h)
}

Suricata IDS Rule

alert tcp any any -> any 873 (msg:"ET TROJAN Possible rsync daemon module enumeration (CVE-2026-53801 pre-exploitation)"; flow:established,to_server; content:"@RSYNCD"; threshold: type both, track by_src, count 10, seconds 60; reference:cve,2026-53801; classtype:attempted-recon; sid:2940001; rev:1;)

This rule alerts on repeated rsync protocol connections (default daemon port 873) from a single source that present the protocol handshake string @RSYNCD, a pattern consistent with automated module enumeration and probing of rsync senders. The threshold suppresses normal single-connection administrative use while flagging scanner-like behavior. Given that rsync protocol payloads are binary and not plaintext, network-layer detection should be complemented with host-level auditing.

Elastic Detection

sequence by host.id with maxspan=60s
  [ process where event.action == "exec" and process.name == "rsync" ]
  [ file where event.category == "file" and event.action in ("rename", "unlink", "link") and file.type == "symbolic_link" ]

This EQL rule correlates the execution of an rsync process with rapid symbolic-link manipulation events on the same host within one minute. The sequence is designed to catch the characteristic TOCTOU churn — an attacker repeatedly swapping a symlink and a directory entry to win the race window during the sender's lstat()/opendir() cycle. Validate the file.type field mapping against the local Elastic Endpoint Schema; adjust the event actions to those emitted by the fleet's endpoint agent.

Splunk SPL Query

index=linux sourcetype=linux_audit (comm=rsync OR exe=*rsync)
| stats values(cwd) as working_dir, values(a0) as arg0, values(uid) as run_as, count by host, _time
| where match(working_dir, "(?i)\.\./") OR match(arg0, "(?i)\.\./|--copy-links|-L")
| eval risk_score = if(count > 5, "high", "medium")
| sort - _time

The query ingests Linux auditd data (linux_audit) for rsync process executions, then filters for invocations with path traversal components or symlink-following arguments. A high execution count in a short window raises the risk score, as an attacker attempting the race condition would likely invoke or trigger the sender repeatedly. Adjust the sourcetype to match the enterprise Linux auditd or Sysmon-for-Linux ingestion pipeline.

Wazuh OSSEC Rule

<group name="cve_2026_53801,">
  <rule id="100231" level="12">
    <if_sid>5710</if_sid>
    <command>rsync</command>
    <description>CVE-2026-53801: rsync sender invoked with suspicious traversal or symlink-following arguments</description>
    <group>rsync,</group>
    <info type="text">Possible attempt to exploit rsync symlink race condition (CVE-2026-53801).</info>
  </rule>
</group>

The rule hooks the existing auditd command-execution parent rule (if_sid 5710, which should be aligned to the numeric ID of the deployment's auditd execve rule) and fires when the executed command is rsync. The elevated level (12) reflects the seriousness of a potential sender-side disclosure event. For environments without auditd integration, a complementary syscheck (FIM) rule can monitor configured rsync module roots for unexpected symlink creation and churn; the if_sid value may need to be adapted to the local Wazuh rule base.

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The only fix reference is OSV, indicating rsync 3.5.0 as the patched release. No vendor advisory has been independently confirmed, and no official vendor fix documentation is available. Validate the 3.5.0 release against official upstream channels before deploying.

1) Immediate mitigations

• If the rsync daemon is not required for business operations, disable it (stop the service and block inbound TCP 873 at the perimeter firewall).
• If the daemon must remain available, restrict network access to trusted source IP ranges only and ensure all rsync modules are configured read-only where writability is not an absolute requirement.
• For writable modules or modules that contain attacker-influenced directories, the rsync service account should run under the least privileged operating-system account available, with filesystem-level access limited to the module root via OS permissions and mandatory access control (SELinux/AppArmor) rather than relying solely on rsync's own path semantics.
• For non-daemon (SSH-based) rsync sender use, audit the server-side commands accepted by authorized_keys; prevent unprivileged users from triggering sender-side scans of directories whose path components are writable by other users.

2) Patch/upgrade steps

• Upgrade to rsync 3.5.0 when it is released and independently verified. Until then, treat deployed versions as vulnerable.
• Test the upgrade in a staging environment that mirrors the production rsync topologies (daemon-mode and SSH-based senders) before rolling out to production.
• Verify the integrity of the upgraded binary against upstream distribution signatures.

3) Long-term hardening

• Separate untrusted writable directories from sensitive data at the filesystem level (different mounts, different hosts) so that even a successful sender-side race cannot cross into sensitive subtrees.
• Establish a monitoring baseline for rsync process invocation and module access; tune the detection rules above to the environment and carry out regular red-team validation of the lstat()/opendir() race window in staging.
• Review rsync module configurations periodically, removing modules that are no longer used and tightening path scoping for all retained modules.
• Subscribe to OSV and NVD notifications for rsync so that updates and independent patch confirmations are received promptly; re-evaluate this CVE when the 3.5.0 release is confirmed.

References

1. NVD — CVE-2026-53801 Detail: https://nvd.nist.gov/vuln/detail/CVE-2026-53801
2. OSV — CVE-2026-53801 Vulnerability Record: https://osv.dev/vulnerability/CVE-2026-53801
3. CWE-59 — Improper Link Resolution Before File Access ('Link Following'): https://cwe.mitre.org/data/definitions/59.html
4. Rsync Project (official site): https://rsync.samba.org/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-53801 not listed at the time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaigns or exploit-in-the-wild evidence for CVE-2026-53801 has been observed as of this report's publication. The EPSS score and CISA KEV status both indicate low current exploitation probability; analysts should nonetheless treat the vulnerability as exploitable and prioritize validation of the claimed 3.5.0 fix.