Rsync CVE-2026-29518: TOCTOU Flaw Allows Privilege Escalation

Rsync versions prior to 3.4.3 are vulnerable to CVE-2026-29518, a high-severity time-of-check to time-of-use (TOCTOU) race condition. The National Vulnerability Database reports this flaw resides in how the rsync daemon handles files. An attacker with write access to a module path can exploit this race to redirect file writes, using symbolic links to replace parent directory components.

This vulnerability allows attackers to create or overwrite arbitrary files, which is critical. If the rsync daemon runs with elevated privileges and the chroot setting is disabled (which it often is in less secure configurations), this can lead directly to privilege escalation by modifying sensitive system files. The attacker’s calculus here is simple: gain a foothold, then leverage a common daemon misconfiguration to own the box.

The CVSS score of 7.0 (HIGH) reflects the potential for complete compromise of confidentiality, integrity, and availability once exploited. Defenders running rsync services need to understand that this isn’t a theoretical issue; it’s a direct path to system control if their configurations are not hardened.