Loading story…
A vulnerability tracked as CVE-2026-29518 affects the rsync daemon and has been described as a symlink-race time-of-check time-of-use (TOCTOU) flaw. The issue is tied to daemon deployments configured with use chroot = no, a setting that removes the additional filesystem isolation normally provided by chroot and can increase exposure to path-handling attacks involving symbolic links.
The flaw has been documented by multiple downstream vendors and trackers, including SUSE and Debian, and is reflected in upstream rsync release notes. Organizations running rsync in daemon mode should review whether use chroot = no is enabled, prioritize vendor patches for affected packages, and assess any services that expose rsync modules to untrusted clients or writable content paths.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
SUSE published bug 1264511 for CVE-2026-29518, describing a symlink-race TOCTOU flaw in the rsync daemon when configured with "use chroot = no."
Debian's security tracker published an entry for CVE-2026-29518, documenting the rsync daemon symlink-race TOCTOU vulnerability.
The rsync project published an update addressing CVE-2026-29518, a symlink-race TOCTOU issue in the rsync daemon affecting configurations with "use chroot = no."
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.suse.com
Open sourcesecurity-tracker.debian.org
Open sourcedownload.samba.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
dCERT issued two advisories for **Rsync** covering separate vulnerabilities that could expose organizations using the file synchronization tool to attack. One advisory describes an **unspecified attack** path in Rsync, indicating a flaw that could be exploited without public technical detail in the notice, while a second advisory warns that another vulnerability could allow attackers to **bypass security measures**. The paired notices indicate multiple security issues affecting Rsync and raise concern for environments that rely on it for file transfer, backup, or synchronization workflows. Although the advisories provide limited public detail, the combination of an attack-enabling flaw and a security-control bypass suggests defenders should review affected Rsync deployments, monitor for vendor guidance, and prioritize remediation once patches or mitigation steps are confirmed.
Jun 29, 2026
Rsync 3.5.0 has been released with fixes for **33 vulnerabilities** affecting the widely used file synchronization utility, including several critical and high-severity issues in the rsync daemon, file handling, path validation, logging, proxy protocol support, and the restricted `rrsync` wrapper. The most serious flaws include client IP spoofing when `proxy protocol = true` is enabled, command-execution risks tied to `RSYNC_CONNECT_PROG` and `rsync-ssl`, arbitrary file overwrite conditions involving symlink and path-handling weaknesses, and bypasses that undermine `rrsync` restrictions. The update also addresses information disclosure, denial-of-service conditions, access-control weaknesses, and file-handling risks that can arise in privileged or chroot-adjacent deployments. Reported mitigations include restricting which hosts may use proxy protocol, avoiding unsafe privileged usage patterns, tightening file-opening behavior with protections such as `O_NOFOLLOW`, and reviewing DNS-dependent controls such as `hosts deny` logic that may be bypassed under some conditions.
Aug 14, 2026
A vulnerability tracked as **CVE-2026-41035** affects `rsync` extended attribute handling and can be triggered when transfers use `-X` or `--xattrs`. The flaw occurs in `receive_xattr()`, where untrusted extended-attribute metadata is mishandled during sorting, causing memory corruption. Red Hat rated the issue **Important** with a **CVSS v3 score of 7.4**, warning that successful exploitation can crash the `rsync` process for denial of service and may also allow arbitrary code execution. Public debugging details tied the bug to `rsync` **3.4.1**, where `qsort()` used the wire-provided attribute count instead of the number of entries actually retained after filtering. On non-Linux, non-root receivers such as **FreeBSD**, filtered namespaces like `security.*` or `trusted.*` could leave stale or uninitialized array elements that led to a `SIGSEGV` in `rsync_xal_compare_names()` via `strcmp()` on a NULL pointer. Red Hat said exploitation requires extended attributes to be explicitly enabled, advised administrators to avoid `-X` or `--xattrs` unless necessary, and published fixes across affected Red Hat Enterprise Linux product streams.
Aug 27, 2026