# CVE-2026-53786: rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override…

Source: https://junglewise.ai/threats/cve-2026-53786-rsync-before-3-5-0-contains-a-filter-rule-bypass-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13  
License: CC BY 4.0 with a link back

CVE-2026-53786 · Severity: medium · CVSS 6.5 · Published 2026-08-13

rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude.

Technologies: [Samba Rsync](https://junglewise.ai/threats/technologies/samba-rsync). Vendors: [Samba](https://junglewise.ai/threats/vendors/samba).

## Quick answers

**Is CVE-2026-53786 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53786 being exploited in the wild.

**How severe is CVE-2026-53786?** Medium severity, with a CVSS score of 6.5, published 13 August 2026.

**Which products and versions are affected?** Samba Rsync. The advisory does not name versions.

**Is there a fix for CVE-2026-53786?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-53786?** Check whether you run Samba Rsync. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Samba Rsync

## Related threats

- [rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses…](https://junglewise.ai/threats/cve-2026-70463-rsync-3-1-0-before-3-5-0-contains-an-authorization-bypass-in-auth)
- [rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated…](https://junglewise.ai/threats/cve-2026-70461-rsync-3-2-5-before-3-5-0-contains-a-heap-out-of-bounds-write)
- [rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows…](https://junglewise.ai/threats/cve-2026-70459-rsync-3-0-0-before-3-5-0-contains-a-null-pointer-dereference)
- [rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is…](https://junglewise.ai/threats/cve-2026-70457-rsync-3-2-3-before-3-5-0-contains-an-out-of-bounds-write-in-parse)
- [rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system…](https://junglewise.ai/threats/cve-2026-70455-rsync-3-4-2-before-3-5-0-contains-a-denial-of-service)