Rsync Daemon TOCTOU Race Condition Enables Arbitrary File Write

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with symbolic links. Attackers with write access to a module path can exploit this race condition to create or overwrite arbitrary files, potentially modifying sensitive system files and achieving privilege escalation when the daemon runs with elevated privileges. This vulnerability can only be triggered if the chroot setting is false.

Casky was already ahead

This CVE exploits attack patterns that Casky's 203matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-29518 exploits a time-of-check to time-of-use (TOCTOU) race condition in Rsync versions before 3.4.3, where attackers with write access to a module path can manipulate symbolic links to redirect file writes outside intended directories. When the Rsync daemon runs with elevated privileges—common in production environments for backup and synchronization tasks—this vulnerability enables attackers to create or overwrite arbitrary files, including sensitive system configurations and binaries. This affects organizations relying on Rsync for automated backups, file distribution, and system administration across Linux, Unix, and other systems that commonly use Rsync daemons.

Casky's 203 mapped security skills leverage Claude AI with extended reasoning to detect the exploitation patterns underlying TA0004 (Privilege Escalation) attacks. Practitioners using Casky would observe detections aligned with MITRE ATT&CK technique T1548 (Abuse Elevation Control Mechanism) and T1036 (Masquerading), identifying suspicious symbolic link creation patterns, unexpected file modifications outside module boundaries, and privilege escalation artifacts in Rsync daemon logs. The platform's skill coverage would flag race condition indicators such as rapid successive file operations, symlink-to-file conversions, and write attempts to restricted directories during Rsync synchronization cycles—enabling practitioners to distinguish legitimate Rsync activity from exploitation attempts before privilege escalation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

203 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-29518.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-office365-audit-logs-for-compromise

cloud security · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-29518

Casky has 203 skills that investigate the attack patterns behind CVE-2026-29518. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn