CVE-2026-114047: FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP proxy deployments using versions from 2.0.0 before 3.32.0 are exposed when no certificate-verification module is configured. The affected behavior concerns the proxy's outbound TLS connection to the RDP target.
What does an attacker need to exploit it?
An attacker must be positioned on the network path between the proxy and its RDP target so they can intercept that outbound connection. They can then present a self-signed certificate or a certificate with the wrong hostname.
What could an attacker obtain or change through exploitation?
A successful attacker can impersonate the RDP target and receive data from the proxied session. The supplied severity vector also indicates potential impacts to confidentiality and integrity, with no availability impact indicated.
What configuration should be reviewed if patching is not immediately possible?
Review whether the proxy has a certificate-verification module configured, since the described acceptance of untrusted target certificates occurs when no such module is configured. Restricting the ability to intercept the proxy-to-target network path also reduces exposure to the described attack.