CVE-2026-53798

A privilege confusion vulnerability in rsync's name-converter subprocess allows a local attacker to achieve privilege escalation. By manipulating the subprocess to return empty values for uid or gid lookups, the attacker forces rsync to incorrectly interpret these as root (uid/gid 0). Consequently, transferred files are improperly assigned root ownership.

A Moderate severity privilege escalation vulnerability exists in rsync. A local attacker can manipulate the name-converter subprocess to return empty user ID (uid) or group ID (gid) values. This manipulation causes rsync to incorrectly assign root ownership to transferred files, resulting in elevated privileges for the attacker.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not set name converter in rsyncd.conf unless you need chroot uid/gid lookups, and do not enable fake super unless you need it. Restrict rsyncd (TCP 873) to trusted clients; if the daemon is unused, disable rsyncd.service. If both options are required, keep the service on a trusted network