AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788960930)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788960930 advisory. - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788960930)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788960930 advisory. - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter...

CVE-2026-53798

A privilege confusion vulnerability in rsync's name-converter subprocess allows a local attacker to achieve privilege escalation. By manipulating the subprocess to return empty values for uid or gid lookups, the attacker forces rsync to incorrectly interpret these as root uid/gid 0. Consequently,...

CVE-2026-78591

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...

PT-2026-84734

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...

SUSE CVE-2026-53798

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

Incorrect Type Conversion or Cast

Overview Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast through the name-converter process. An attacker can cause transferred files to be owned by root by manipulating responses from the name-converter to return empty values for uid or gid lookups, which are...

CVE-2026-53798

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

AZL-95804 CVE-2026-53798 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

ALPINE-CVE-2026-53798

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

CVE-2026-53798 rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

CVE-2026-53798

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

CVE-2026-53798 rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

CVE-2026-53798

CVE-2026-53798 affects rsync before 3.5.0. A privilege-confusion in the name-converter subprocess uid/gid mapping can let a local attacker cause transferred files to be owned by root. If the name-converter returns an empty uid/gid lookup (or signals fake super-user status), rsync may treat uid/gi...

CVE-2026-53798

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

CVE-2026-53798 rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

EUVD-2026-58094

rsync tbefore 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns a...

PT-2026-71636

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A privilege confusion issue exists in the name-converter subprocess uid/gid mapping. Local attackers can cause transferred files to be owned by root by influencing the name-converter responses to retur...

CVE-2026-53798: Incorrect Type Conversion or Cast

rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an...

Improper Authentication

auth is vulnerable to Improper Authentication. The vulnerability is due to incorrect mapping of all Patreon OAuth accounts to the same local user ID, which allows an attacker to gain unauthorized access through account merging and privilege confusion...