CVE-2026-70454 is a vulnerability in RsyncProject's rsync software affecting versions 3.2.0 through 3.2.3 in openssl mode and rsync-ssl through 3.4.4 in stunnel mode. The issue is improper TLS certificate validation (CWE-295), where the client does not correctly verify server certificates against trusted certificate authorities or check hostname matching. This allows on-path attackers to present self-signed or invalid certificates to intercept and manipulate encrypted rsync sessions. The vulnerability has a CVSS 4.0 base score of 7.6, indicating high severity. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation enables an attacker positioned on the network path to intercept and decrypt rsync encrypted sessions or tamper with their content without detection by the client. This compromises the confidentiality and integrity of data transferred via rsync over TLS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider avoiding the affected rsync versions in openssl and stunnel modes or use alternative secure transfer methods. Monitor vendor communications for updates on official patches or mitigations.