PT-2026-42153

🗓️ 20 May 2026 00:00:00Reported by Positive TechnologiesType

Rsync pre 3.4.3 has a TOCTOU race in daemon file handling allowing module-path writers to redirect via symlinks and escalate privileges when chroot is false.

Reporter	Title	Published	Views	Family All 160
attackerkb	CVE-2026-29518	20 May 202612:48	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : rsync, rsync-daemon (ALAS2023-2026-3131)	29 Sep 202600:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0184: rsync (ALINUX3-SA-2026:0184)	9 Jul 202600:00	–	nessus
Tenable Nessus	CentOS Linux 7.9 [CIQ] Security Update: rsync / rsync-debuginfo Multiple Vulnerabilities (ciqsa-2026_1480)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 10.2 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource / etc Multiple Vulnerabilities (crlsa-2026_26332)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8.6 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource Multiple Vulnerabilities (ciqsa-2026_1365)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 8 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource Multiple Vulnerabilities (crlsa-2026_26408)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9.2 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_1364)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9.4 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_1363)	1 Oct 202600:00	–	nessus
Tenable Nessus	Rocky Linux 9.6 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_1362)	1 Oct 202600:00	–	nessus

Source	Link
ubuntu	www.ubuntu.com/security/notices/USN-8283-1
errata	www.errata.rockylinux.org/RLSA-2026:26408
bugzilla	www.bugzilla.suse.com/1264512
cve	www.cve.org/CVERecord
osv	www.osv.dev/vulnerability/DEBIAN-CVE-2026-29518
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-rsync-cve-2026-29518--8.0
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41035
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-53803
suse	www.suse.com/security/cve/CVE-2025-10158
errata	www.errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1780480701.html

13 Oct 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17 - 7.8

CVSS 47.3

EPSS0.00152

SSVC