CVE-2026-70454

A flaw was found in the rsync-ssl wrapper script's TLS certificate validation. An on-path attacker can present self-signed or invalid certificates to intercept, decrypt, or tamper with encrypted sessions. Because rsync fails to validate the certificate against a trusted CA or verify hostname matching, this interception occurs without detection by the client.

This Moderate impact flaw in rsync allows on-path attackers to intercept and tamper with encrypted sessions. The vulnerability arises from insufficient TLS certificate validation, enabling an attacker to present invalid certificates and compromise data integrity and confidentiality without detection. Exploitation requires an attacker to be positioned to intercept network traffic between the rsync client and server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not use rsync-ssl with the openssl or stunnel backends. Use rsync over SSH, which authenticates the host and encrypts the session: rsync -avz -e ssh /source user@remote:/destination. If daemon TLS cannot be avoided, restrict those sessions to trusted networks