CVE-2026-53802

Executive Summary

CVE-2026-53802 is an arbitrary file read vulnerability in rsync versions prior to 3.5.0, arising from improper symlink handling in input configuration file processing. The flaw affects all rsync installations that process --files-from, --password-file, or filter merge files, particularly in daemon operation mode where the service runs with elevated privileges. Successful exploitation allows a local attacker to read files accessible to the rsync daemon process, potentially exposing sensitive credentials, system files, or application data. The vulnerability carries a CVSS score of 7.1 (High) with high confidentiality and integrity impacts, and no patch is currently available from vendor sources tracked.

Technical Analysis

The vulnerability resides in rsync's handling of symlinks when processing various input configuration files. The NVD description identifies three specific attack vectors: --files-from, --password-file, and filter merge files. These input mechanisms are parsed by the rsync process before and during file transfer operations.

The core flaw is a path traversal and symlink following issue that allows an attacker to redirect file reads outside the intended module root. In a standard rsync daemon configuration, the module root defines the directory boundary within which file operations should be confined. However, when the daemon processes --files-from lists, it follows symlinks contained within those lists without proper validation against the module root boundary. Similarly, --password-file handling permits an attacker to supply a symlink path that redirects the process to read authentication credentials from arbitrary files accessible to the daemon account.

The CWE-61 classification (UNIX Symbolic Link Following) confirms that the issue is fundamentally about inadequate symlink validation. When an attacker can place a symlink at a predictable path — either through prior write access, shared directory manipulation, or control over the input file content — they can redirect rsync's file read operations to any file on the system that the daemon process can access.

The vulnerability also includes a configuration injection vector where the attacker supplies a --files-from path that escapes the daemon module root through directory traversal sequences. This bypasses the access controls that normally constrain rsync daemon operations to the configured module directory subtree.

The integrity impact (I:H) in the CVSS vector indicates that successful exploitation could also allow the attacker to influence file contents, though the primary described impact is the unauthorized read of arbitrary files. The attack vector is local (AV:L) with low attack complexity (AC:L), requiring only low privileges (PR:L) and no user interaction (UI:N).

Since no patch confidence exists (0/4) and no vendor-fixed version is confirmed, this remains an active vulnerability in all shipped rsync versions before 3.5.0. The affected scope is significant given rsync's widespread deployment in backup pipelines, file synchronization systems, and CI/CD infrastructure.

Exploitation Scenarios

Reconnaissance and Target Identification

An attacker with local access to a system running rsync would first enumerate available rsync daemon configurations, identify module roots, and determine whether --files-from or --password-file options are in use. This reconnaissance involves examining running processes, configuration files in /etc/rsyncd.conf, and systemd service definitions. The attacker would also map the rsync process's privilege level — whether it runs as root or a dedicated service account — to determine the potential impact of a successful file read.

Trigger Mechanism

The attack requires one of three conditions to be met: (1) the attacker can place a symlink at a predictable --files-from path used by the service; (2) the attacker has control over a --password-file path such that a symlink can redirect the read; or (3) the attacker can craft a --files-from file containing paths that escape the daemon module root. In daemon mode, the attacker would connect to the rsync daemon and request operations that trigger processing of these configuration files.

Exploitation Execution

At the vulnerability-class level, the attacker exploits the symlink following behavior by creating a symbolic link at the expected configuration file location that points to a sensitive target file (for example, /etc/shadow, application configuration files, or SSH private keys). When the rsync daemon processes the --files-from list or reads the password file, it follows the symlink and reads the target file's contents. For the path traversal variant, the attacker crafts a --files-from file containing relative paths with traversal sequences (such as ../../) that escape the module root directory and point to arbitrary filesystem locations.

The attack chain can also operate without a pre-existing symlink: if the attacker can influence the --files-from file content (e.g., through a writable staging directory), they can insert traversal paths directly. No public PoC is currently available, so the exact implementation details are inferred from the vulnerability class description.

Post-Exploitation Impact

Once an arbitrary file read succeeds, the attacker gains access to any file readable by the rsync daemon process. In typical deployments where the daemon runs as root or with elevated privileges, this could include password hashes, application secrets, TLS private keys, database credentials, and other sensitive system files. This information can be leveraged for privilege escalation, lateral movement, or persistent access to the compromised system.

Impact Assessment

The CVSS score of 7.1 (High) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N reflects the following impacts:

• Confidentiality (High): The primary impact is unauthorized disclosure of sensitive files readable by the rsync daemon process. This includes credential stores, configuration secrets, and potentially system-critical files. The impact is amplified when rsync runs with root privileges.
• Integrity (High): The CVSS vector indicates high integrity impact — the attack can affect file contents, though the NVD description focuses on file reading rather than modification. The high integrity score is notable and suggests potential for file manipulation as a secondary effect.
• Availability (None): No availability impact is identified in the CVSS vector.

The attack requires local access with low privileges, making it relevant for multi-tenant environments, shared hosting platforms, and any system where untrusted users have shell access. The blast radius is limited to the filesystem accessible by the rsync process, but in daemon configurations this often represents the entire system.

Organizations running rsync-based backup infrastructure, rsync mirroring services, or rsync in cron-driven automation pipelines are most at risk. The lack of user interaction required (UI:N) and low privileges needed (PR:L) lower the barrier to exploitation significantly.

Detection Guidance

Since no patch exists, detection is the primary defense mechanism. The following detection rules focus on anomalous rsync behavior, suspicious symlink creation, and unusual file access patterns.

Sigma Rule

title: Suspicious Symlink Creation Near rsync Config Paths
id: 7e3f9a2c-8b41-4d6e-a1f5-3c92d8e6b7a4
status: experimental
description: Detects creation of symlinks targeting sensitive files in locations used by rsync for --files-from, --password-file, or filter merge file processing
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53802
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: process_creation
    product: linux
detection:
    selection_symlink:
        Image|endswith: '/ln'
        CommandLine|contains: '-s'
    selection_target:
        CommandLine|contains|all:
            - '/etc/shadow'
            - '/etc/passwd'
            - '.ssh'
            - 'id_rsa'
            - '.aws'
            - 'credentials'
    selection_rsync_path:
        CommandLine|contains:
            - '/files-from'
            - '/password-file'
            - 'rsync'
    condition: selection_rsync_path and selection_symlink
    timeframe: 15m
level: high
falsepositives:
    - Legitimate admin symlink creation for path aliases
    - Backup tooling that intentionally links config files
tags:
    - attack.t1559
    - attack.t1068
    - cve.2026.53802

YARA Rule

rule rsync_symlink_file_read_exploit {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects rsync commands attempting to use symlinked or traversing --files-from paths"
        cve = "CVE-2026-53802"
        date = "2026-01-15"
        severity = "high"
    strings:
        $rsync = "rsync" ascii wide
        $files_from = "--files-from" ascii wide
        $password_file = "--password-file" ascii wide
        $filter_merge = "--filter" ascii wide
        $dotdot = ".." ascii wide
        $symlink_flag = "-l" ascii wide
        $symlink_flag_long = "--link-dest" ascii wide
    condition:
        $rsync and ($files_from or $password_file or $filter_merge) and (#dotdot > 2)
}

Suricata IDS Rule

alert tcp any any -> any 873 (msg:"ET EXPLOIT rsync Arbitrary File Read Attempt (CVE-2026-53802)"; flow:to_server,established; content:"files-from"; nocase; content:".."; distance:0; within:50; content:"rsync"; nocase; distance:0; within:20; classtype:attempted-admin; sid:20260502; rev:1; metadata:attack_target Linux, created_at 2026_01_15, cve CVE-2026-53802, deployment Perimeter, signature_severity Major, tag Exploit;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.type == "start" and process.name == "ln" and process.args == "-s" and process.command_line like "*shadow*"]
  [file where event.action == "read" and file.name in ("shadow", "passwd", "id_rsa") and process.name == "rsync"]

Splunk SPL Query

index=linux_secure earliest=-24h
(process_name=ln OR process_name=rsync)
| search (command_line="*-s*" AND (command_line="*shadow*" OR command_line="*passwd*" OR command_line="*.ssh*"))
   OR (command_line="*rsync*" AND (command_line="*--files-from*" OR command_line="*--password-file*") AND command_line="*\../*")
| stats count by host, user, process_name, command_line
| where count > 0

Wazuh OSSEC Rule

<group name="rsync_cve_2026_53802,">
    <rule id="100802" level="12">
        <if_sid>5715</if_sid>
        <regex>ln -s.*shad|ln -s.*passwd</regex>
        <description>CVE-2026-53802 - Suspicious symlink creation targeting sensitive files indicates possible rsync file read exploitation</description>
        <group>rsync,vulnerability,exploit_attempt</group>
        <mitre>
            <id>T1559</id>
        </mitre>
    </rule>

    <rule id="100803" level="10">
        <if_sid>5715</if_sid>
        <regex>rsync.*files-from.*\/\.\.\/|rsync.*password-file.*\/\.\.\/</regex>
        <description>CVE-2026-53802 - Directory traversal attempt in rsync input configuration file</description>
        <group>rsync,vulnerability,exploit_attempt</group>
        <mitre>
            <id>T1559</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status: No vendor patch is currently available. Patch confidence is 0/4, and the affected version range is all rsync versions prior to 3.5.0. The documented fix is the release of rsync 3.5.0, which contains hardening against the described symlink following behaviors.

Immediate Mitigations:

1. Restrict rsync daemon privileges: Run the rsync daemon under a dedicated, least-privilege service account rather than root. This limits the filesystem scope accessible to an attacker exploiting file reads.
2. Remove world-writable directories from rsync module paths: Ensure that directories used as rsync module roots are not writable by unprivileged users, preventing symlink placement at predictable paths.
3. Monitor filesystem for suspicious symlinks: Implement file integrity monitoring on directories where rsync input files are stored, watching for unexpected symlink creation.
4. Disable --files-from and --password-file in untrusted environments: Where the feature is not essential, avoid using these options or restrict their usage to trusted administrative processes only.
5. Segment rsync access: Limit rsync daemon accessibility to trusted network hosts and users; apply egress filtering where possible.

Upgrade Steps:

1. Monitor rsync project releases for 3.5.0 or any pre-3.5.0 security backports addressing CVE-2026-53802.
2. Before upgrading, review the rsync changelog for the specific fix and validate that deployment environments are compatible with the new version.
3. After upgrade, thoroughly test rsync functionality in backup and synchronization workflows to ensure regression-free operation.

Long-Term Hardening:

1. Apply the principle of least privilege to all rsync deployments, both daemon and client-side.
2. Implement network-level controls restricting access to rsync ports (873/TCP and 873/UDP) to authorized systems only.
3. Use SELinux or AppArmor confinement for rsync daemon processes to restrict filesystem access beyond basic OS permissions.
4. Conduct regular vulnerability scans and subscribe to rsync security announcements for timely patch deployment.
5. Harden credential management: Avoid --password-file usage where possible; prefer SSH-based authentication or over rsync via SSH tunneling.
6. Implement strong filesystem permissions on all sensitive system files to prevent read access by the rsync daemon account even if file reads are achieved.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-53802
2. CWE-61 — UNIX Symbolic Link Following: https://cwe.mitre.org/data/definitions/61.html
3. rsync Project Homepage (upstream releases/monitoring): https://rsync.samba.org/
4. MITRE ATT&CK — Exploitation for Privilege Escalation (T1068): https://attack.mitre.org/techniques/T1068/
5. MITRE ATT&CK — Inter-Process Communication (T1559): https://attack.mitre.org/techniques/T1559/

Threat Actor Activity: No known exploitation campaigns or threat actor activity have been publicly associated with CVE-2026-53802 as of this report. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing. EPSS scoring has not yet been assigned by FIRST.org. No public proof-of-concept or exploit code is currently available, and no Nuclei templates have been published for this vulnerability.

Report generated by Valtersit Threat Intelligence — all technical claims derived exclusively from the provided CVE intelligence data.