{
  "threat_severity" : "Moderate",
  "public_date" : "2026-05-20T00:00:00Z",
  "bugzilla" : {
    "description" : "rsync: rsync: Symlink race vulnerability allows unauthorized file operations",
    "id" : "2469058",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2469058"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
    "status" : "draft"
  },
  "cwe" : "CWE-59",
  "details" : [ "Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat that allow local attackers to redirect operations to files outside the exported rsync module. Attackers with local filesystem access can exploit the timing window between path resolution and syscall execution by swapping symlinks to apply sender-supplied permissions, ownership, timestamps, or filenames to arbitrary files outside the intended module boundary on rsync daemons configured with 'use chroot = no'.", "A flaw was found in rsync. A local attacker with filesystem access on the daemon host can exploit a symlink race vulnerability (CWE-367 Time-of-check to time-of-use) in rsync daemons configured with 'use chroot = no'. This allows the attacker to redirect path-based system calls, such as chmod, lchown, or unlink, outside the intended module. This could lead to unauthorized file operations or other security bypasses." ],
  "statement" : "Moderate: A symlink race vulnerability affects rsync daemons when configured with `use chroot = no`, allowing a local attacker with filesystem access to perform unauthorized file operations outside the intended module. This risk is present only when the non-default `use chroot = no` setting is active.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Out of support scope",
    "package_name" : "rsync",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Fix deferred",
    "package_name" : "rsync",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "rsync",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "rsync",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "rsync",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "rhcos",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-43619\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43619" ],
  "name" : "CVE-2026-43619",
  "mitigation" : {
    "value" : "To mitigate this issue, ensure that the `rsync` daemon is configured with `use chroot = yes`. This can be achieved by editing the `rsyncd.conf` file, typically located at `/etc/rsyncd.conf`, and setting `use chroot = yes` within the relevant module configuration. After modifying the configuration, the `rsync` service must be restarted for the changes to take effect. This may temporarily interrupt active `rsync` operations.",
    "lang" : "en:us"
  },
  "csaw" : false
}