CVE-2026-44509

Received Received - Intake

Rsync Symlink Race Condition in File Permissions

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, previous bug fixes for symlink races in open() calls missed races in other path based system calls like chmod() and chown(). For rsync daemons with "use chroot = no" this allows an attacker with local filesystem access to change permissions, ownership or timestamp on a file outside the exported module. This issue is fixed in version 3.4.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-44509

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

Rsync before 3.4.3 has a flaw in handling symlink races. When 'use chroot = no' is enabled, attackers with local filesystem access can exploit path-based system calls like chmod() or chown() to modify permissions, ownership, or timestamps on files outside the intended module.

Detection Guidance

Detecting this vulnerability requires checking the rsync version installed on your system. Run 'rsync --version' to see if it is older than 3.4.3. If it is, the system is vulnerable. Additionally, check rsync daemon configurations for 'use chroot = no' which increases exposure.

Impact Analysis

If you run an rsync daemon with 'use chroot = no', an attacker with local access could alter critical files, leading to unauthorized permission changes, ownership takeover, or timestamp manipulation. This could disrupt services or hide malicious activity.

Compliance Impact

This vulnerability could violate compliance by allowing unauthorized file modifications, potentially breaching data integrity or confidentiality requirements in GDPR or HIPAA. Unauthorized permission changes may also indicate poor access controls.

Mitigation Strategies

Upgrade rsync to version 3.4.3 or later immediately. If upgrading is not possible, disable rsync daemon services or set 'use chroot = yes' in the rsyncd.conf file to limit filesystem access. Review and restrict local filesystem access for users.

Hi! I’m here to help you understand CVE-2026-44509. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70