CVE-2026-109953: FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin
FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode TSPasswordCreds and the Client Info PDU to obtain reusable administrative domain, username, and password values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRDP versions from 3.0.0 up to, but not including, 3.32.0 are affected when connections use the /restricted-admin option.
What must an attacker control or observe to obtain credentials?
The attacker needs to operate a compromised RDP destination host or be positioned as a man in the middle for the RDP connection. Under those conditions, they can decode TSPasswordCreds and the Client Info PDU.
What credentials could be disclosed?
The disclosed values can include reusable administrative domain, username, and cleartext password credentials.
How can an organization determine whether it may already be affected?
Review FreeRDP client versions and connection invocations for use of /restricted-admin. Connections using that option to a compromised or man-in-the-middle destination may have exposed the administrative credentials used for the session.