High severity8.0NVD Advisory· Published Aug 13, 2026· Updated Sep 8, 2026
CVE-2026-70454
CVE-2026-70454
Description
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5- osv-coords4 versionspkg:rpm/almalinux/rsync-daemonpkg:rpm/almalinux/rsyncpkg:rpm/almalinux/rsync-rrsyncpkg:rpm/opensuse/rsync&distro=openSUSE%20Leap%2016.0
< 3.2.7-1.el9_8+ 3 more
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.2.7-1.el9_8
- (no CPE)range: < 3.4.1-160000.6.1
Patches
Vulnerability mechanics
References
3News mentions
1- Rsync: 25 Vulnerabilities Disclosed Together, Affecting Versions Before 3.5.0Vypr Intelligence · Aug 13, 2026