CVE-2026-70454 rsync < 3.5.0 TLS Certificate Validation Bypass via SSL/OpenSSL Mode
Attackers can intercept rsync sessions by bypassing TLS certificate validation in SSL or stunnel modes, allowing decryption or tampering of data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-70454?
CVE-2026-70454 is a high-severity vulnerability in RsyncProject rsync, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client.
Weakness: CWE-295
Which versions are affected by CVE-2026-70454?
How do I fix CVE-2026-70454?
Upgrade to a fixed version.
Is CVE-2026-70454 being exploited?
There is no known exploitation of CVE-2026-70454 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-70454, AZL-95777, BELL-CVE-2026-70454, DEBIAN-CVE-2026-70454, ECHO-8d10-95d4-4155, GHSA-3c3x-ww2w-5r5p and 2 more.