The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1788953354 advisory.

  - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files     outside the intended module root when use chroot is disabled and the module root path or a component of it     is a symlink. The daemon calls chdir() to the module root at session initialization without resolving     symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files     relative to the symlink target rather than the intended module root, enabling unauthorized file access.
    (CVE-2026-53784)

  - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to     override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers     can inject client-side merge file directives during filter evaluation to introduce rules that supersede     daemon module-level restrictions, gaining access to files the module filter was intended to exclude.
    (CVE-2026-53786)

  - rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to     expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file     list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the     transfer root. Attackers can exploit multiple variants including implied parent reclassification,     synthetic root path construction, legacy protocol behavior below version 30, and non-directory root     handling to cause the receiver to delete files outside the authorized destination directory.
    (CVE-2026-53789)

  - rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite     arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or     daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during     ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege     escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon     configurations. (CVE-2026-53803)

  - rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process     that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry     not typed as a directory. The daemon dereferences the first file list entry as a directory structure     pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference     that terminates the client connection. (CVE-2026-70459)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3634-1 advisory.

    - CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist)     (bsc#1269041).
    - CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' (bsc#1269042).
    - CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
    - CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
    - CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol     (bsc#1269046).
    - CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent     (bsc#1269047).
    - CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
    - CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address     (bsc#1269049).
    - CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative     (bsc#1269050).
    - CVE-2026-53793: Chroot '/./' inner-module escape via a parent-component symlink (bsc#1269051).
    - CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
    - CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link     confinement       (bsc#1269053).
    - CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (TOCTOU) (bsc#1269054).
    - CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure     (bsc#1269055).
    - CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
    - CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set (local     privilege       escalation) (bsc#1269056).
    - CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary     file deletion       outside the source tree (bsc#1269057).
    - CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-     tree disclosure       (bsc#1269058).
    - CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files     (bsc#1269039).
    - CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths       (bsc#1269040).
    - CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the     host it was meant       to block (bsc#1273441).
    - CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain     (bsc#1273440).
    - CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
    - CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
    - CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on     maxargs       (bsc#1273437).
    - CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
    - CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
    - CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-     directory       transfer root (bsc#1273434).
    - CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving     via an in-       module symlink (bsc#1273433).
    - CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
    - CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
    - CVE-2026-70463: 'auth users' ignores documented comma-only parsing, silently skipping a deny/read-only     rule       (bsc#1273430).
    - CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module     (bsc#1273429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fee67ad5-a05e-11f1-ad2b-40b034429ecf advisory.

    rsync project reports:
    This release fixes 33 security issues found during a focused audit of rsync's path           handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports               from external researchers -- plus several robustness hardenings. CVE IDs were assigned               by VulnCheck (CNA); the precise introduced in version ranges accompany each advisory,               and many are much narrower than everything before 3.5.0. Every fix ships with a               regression test in the test suite that fails on the unfixed tree.
    support/rrsync (the restricted SSH wrapper):
    Daemon protocol / identity:
    Injection and memory safety:
    Peer-triggerable memory corruption in the daemon protocol:
    Daemon availability and access control:
    Client-side:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21650-1 advisory.

    - CVE-2026-53783: rrsync restricted-directory escape (validation-vs-exec race + unsafe option allowlist)     (bsc#1269041).
    - CVE-2026-53784: Daemon module-root chdir escape under use chroot = no (bsc#1269042).
    - CVE-2026-53785: --relative implied-parent creation escapes the destination tree (bsc#1269043).
    - CVE-2026-53786: Daemon --filter merge file bypasses the module filter list (bsc#1269044).
    - CVE-2026-53788: Daemon name-converter accepts newline-bearing names into its line protocol     (bsc#1269046).
    - CVE-2026-53789: Malicious sender expands --delete scope by reclassifying an implied parent     (bsc#1269047).
    - CVE-2026-53790: Command / argument injection via unquoted peer- or host-controlled values (bsc#1269048).
    - CVE-2026-53791: PROXY-protocol mode lets a direct client spoof the daemon's source address     (bsc#1269049).
    - CVE-2026-53792: Receiver-supplied zero checksum block length drives sender matching negative     (bsc#1269050).
    - CVE-2026-53793: Chroot /./ inner-module escape via a parent-component symlink (bsc#1269051).
    - CVE-2026-53794: Remote peer disables the per-allocation sanity cap via --max-alloc=0 (bsc#1269052).
    - CVE-2026-53795: Receiver write escape via an absolute --temp-dir / --link-dest disabling rename/link     confinement       (bsc#1269053).
    - CVE-2026-53796: Non-daemon receiver destination-chdir symlink race (bsc#1269054).
    - CVE-2026-53797: Sender source-tree parent-component symlink race -> out-of-tree disclosure     (bsc#1269055).
    - CVE-2026-53798: Daemon name-converter empty response maps an unknown name to uid/gid 0 (bsc#1269045).
    - CVE-2026-53799: Receiver ACL/xattr application follows a symlink-race -> arbitrary ACL set     (bsc#1269056).
    - CVE-2026-53800: Sender --remove-source-files unlink follows a parent-component symlink race -> arbitrary     file deletion       outside the source tree (bsc#1269057).
    - CVE-2026-53801: Sender/daemon directory-scan enumeration escapes the transfer root / module -> out-of-     tree disclosure       (bsc#1269058).
    - CVE-2026-53802: Arbitrary file read / transfer-shaping via symlinked operator-supplied input files     (bsc#1269039).
    - CVE-2026-53803: Arbitrary file write / privilege escalation via symlinked operator-supplied output paths       (bsc#1269040).
    - CVE-2026-70452: `hosts deny` fails OPEN when a configured hostname cannot be resolved, admitting the     host it was meant       to block (bsc#1273441).
    - CVE-2026-70453: Quadratic CPU exhaustion in hash_search() from a crafted equal-weak-checksum chain     (bsc#1273440).
    - CVE-2026-70454: rsync-ssl establishes an unauthenticated TLS connection (bsc#1273439).
    - CVE-2026-70455: Peer-controlled Zstandard worker exhaustion on an rsync daemon (bsc#1273438).
    - CVE-2026-70456: Remote out-of-bounds heap write in read_args() when the argument count lands exactly on     maxargs       (bsc#1273437).
    - CVE-2026-70457: Attacker-chosen-offset write in parse_size_arg() error formatting (bsc#1273436).
    - CVE-2026-70458: Out-of-bounds write from a FLAG_HLINKED file entry accepted without -H (bsc#1273435).
    - CVE-2026-70459: Per-connection daemon child crash from a crafted first incremental file list with a non-     directory       transfer root (bsc#1273434).
    - CVE-2026-70460: Daemon module-root escape through a peer-supplied --partial-dir / --backup-dir resolving     via an in-       module symlink (bsc#1273433).
    - CVE-2026-70461: Peer-driven one-byte heap out-of-bounds write in add_implied_include() (bsc#1273432).
    - CVE-2026-70462: Peer-supplied MSG_IO_TIMEOUT defeats the client's own I/O timeout (bsc#1273431).
    - CVE-2026-70463: auth users ignores documented comma-only parsing, silently skipping a deny/read-only     rule       (bsc#1273430).
    - CVE-2026-70464: Unauthenticated pre-transfer handshake DoS locks out an rsync daemon module     (bsc#1273429).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the rsync package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to     override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers     can inject client-side merge file directives during filter evaluation to introduce rules that supersede     daemon module-level restrictions, gaining access to files the module filter was intended to exclude.
    (CVE-2026-53786)

Note that Nessus relies on the presence of the package as reported by the vendor.

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1788773414 advisory.

  - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to     override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers     can inject client-side merge file directives during filter evaluation to introduce rules that supersede     daemon module-level restrictions, gaining access to files the module filter was intended to exclude.
    (CVE-2026-53786)

  - rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to     expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file     list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the     transfer root. Attackers can exploit multiple variants including implied parent reclassification,     synthetic root path construction, legacy protocol behavior below version 30, and non-directory root     handling to cause the receiver to delete files outside the authorized destination directory.
    (CVE-2026-53789)

  - rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process     that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry     not typed as a directory. The daemon dereferences the first file list entry as a directory structure     pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference     that terminates the client connection. (CVE-2026-70459)

  - rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users     parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries     of the form @Group Name where the group name contains a space. The space within the group name causes the     parser to split the entry at the space boundary, discarding the deny rule associated with the group. An     authenticated user whose username or group membership would be denied by an @Group Name auth users entry     can connect to a restricted module because the deny rule is silently discarded during parsing.
    (CVE-2026-70463)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788960930 advisory.

  - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to     override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers     can inject client-side merge file directives during filter evaluation to introduce rules that supersede     daemon module-level restrictions, gaining access to files the module filter was intended to exclude.
    (CVE-2026-53786)

  - rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote     attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged     source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in     the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would     otherwise be blocked based on their real source address. (CVE-2026-53791)

  - rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid     mapping that allows local attackers to cause transferred files to be owned by root by influencing name-     converter responses to return empty values. When the name-converter subprocess returns an empty response     for a uid or gid lookup, rsync incorrectly interprets it as a successful resolution to uid/gid 0 (root)     rather than a lookup failure, and if the name-converter also signals fake super-user status, rsync     proceeds with root ownership assignments for transferred files. (CVE-2026-53798)

  - rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process     that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry     not typed as a directory. The daemon dereferences the first file list entry as a directory structure     pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference     that terminates the client connection. (CVE-2026-70459)

  - rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users     parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries     of the form @Group Name where the group name contains a space. The space within the group name causes the     parser to split the entry at the space boundary, discarding the deny rule associated with the group. An     authenticated user whose username or group membership would be denied by an @Group Name auth users entry     can connect to a restricted module because the deny rule is silently discarded during parsing.
    (CVE-2026-70463)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1789029795 advisory.

  - Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file     handling that allows attackers to redirect file writes outside intended directories by replacing parent     directory components with symbolic links. Attackers with write access to a module path can exploit this     race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and     achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only     be triggered if the chroot setting is false. (CVE-2026-29518)

  - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files     outside the intended module root when use chroot is disabled and the module root path or a component of it     is a symlink. The daemon calls chdir() to the module root at session initialization without resolving     symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files     relative to the symlink target rather than the intended module root, enabling unauthorized file access.
    (CVE-2026-53784)

  - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to     override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers     can inject client-side merge file directives during filter evaluation to introduce rules that supersede     daemon module-level restrictions, gaining access to files the module filter was intended to exclude.
    (CVE-2026-53786)

  - rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to     expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file     list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the     transfer root. Attackers can exploit multiple variants including implied parent reclassification,     synthetic root path construction, legacy protocol behavior below version 30, and non-directory root     handling to cause the receiver to delete files outside the authorized destination directory.
    (CVE-2026-53789)

  - rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite     arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or     daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during     ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege     escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon     configurations. (CVE-2026-53803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
352675	CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2026:1788953354)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	high
337988	SUSE SLES15 Security Update : rsync (SUSE-SU-2026:3634-1)	Nessus	SuSE Local Security Checks	2026/8/19	2026/9/1	critical
341069	FreeBSD : net/rsync -- multiple vulnerabilities (fee67ad5-a05e-11f1-ad2b-40b034429ecf)	Nessus	FreeBSD Local Security Checks	2026/8/27	2026/9/16	critical
351050	Amazon Linux 2023 : rsync, rsync-daemon (ALAS2023-2026-3131)	Nessus	Amazon Linux Local Security Checks	2026/9/29	2026/9/29	critical
341163	openSUSE 16 Security Update : rsync (openSUSE-SU-2026:21650-1)	Nessus	SuSE Local Security Checks	2026/8/28	2026/9/16	critical
374974	Photon OS 5.0: Rsync PHSA-2026-5.0-91-0991	Nessus	PhotonOS Local Security Checks	2026/11/2	2026/11/2	critical
335032	Linux Distros Unpatched Vulnerability : CVE-2026-53786	Nessus	Misc.	2026/8/13	2026/9/30	medium
361289	CentOS Linux 8.4 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1788773414)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	high
352897	Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788960930)	Nessus	Rocky Linux Local Security Checks	2026/9/30	2026/9/30	critical
352056	CentOS Linux 6 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS6:CLSA-2026:1789029795)	Nessus	CentOS Local Security Checks	2026/9/30	2026/10/13	high

检测

插件搜索

high

critical

critical

critical

critical

critical

medium

high

critical

high