CVE-2026-70454

CVE-2026-70454 exposes a critical gap in rsync's TLS transport modes: certificate validation was not enforced, allowing trivial man-in-the-middle attacks against supposedly encrypted rsync sessions. The CVSS 8 rating is technically accurate for the vulnerability's impact, but the EPSS of 0.0019 reflects a narrower reality — this affects a code path (rsync's openssl mode and the rsync-ssl stunnel wrapper) that most production deployments have already abandoned in favor of SSH transport. That abandonment, however, is exactly what makes this worth your attention: organizations still running rsync-over-TLS likely did so specifically because they believed TLS provided MITM protection equivalent to SSH. The CVSS score assumes a reasonable user expectation that the software failed to meet — but there's a deeper question that changes how you should prioritize this: was the missing validation ever a deliberate design choice rather than an oversight? The openssl mode in rsync has been effectively unmaintained since approximately rsync 3.2.0, and if the maintainers intentionally shipped it as a minimal encryption wrapper expecting users to handle authentication out-of-band, this CVE formalizes a gap between what the ecosystem assumed TLS mode provided and what the software was ever designed to deliver. The stunnel wrapper failure in rsync-ssl is a distinct vulnerability class — if rsync-ssl invokes stunnel without explicitly setting verification flags, it creates an invisible integration failure where safe defaults get silently overridden. Regardless of whether this was regression, design gap, or documentation failure, your remediation path is straightforward: audit any rsync-over-TLS workflows in your environment, migrate those workloads to SSH transport if possible, or if TLS is required, explicitly configure certificate validation in your stunnel configuration with `verifyChain = yes` or equivalent. The CVSS 8 will trigger compliance and scanning attention, but the actual exploitation surface is narrower than the severity score implies.

Reviewed through automated stages and approved by a human before publication.