CVE-2026-70454: rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/rsyncto a version that resolves this vulnerability.Fixed in 3.5.0+ds1-0+deb13u1Fixed in 3.5.1+ds1-2Fixed in 3.5.2+ds1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-70454?
The severity of CVE-2026-70454 is rated as high with a score of 8.
How does CVE-2026-70454 affect rsync?
CVE-2026-70454 allows on-path attackers to intercept encrypted sessions by exploiting a TLS certificate validation bypass.
Which versions of rsync are impacted by CVE-2026-70454?
Rsync versions 3.2.0 through 3.2.3 in openssl mode and rsync-ssl versions up to 3.4.4 in stunnel mode are impacted.
How do I fix CVE-2026-70454?
To fix CVE-2026-70454, upgrade rsync to version 3.5.0 or later.
What are the potential risks of CVE-2026-70454?
The potential risks of CVE-2026-70454 include interception of encrypted sessions by attackers using self-signed or invalid certificates.