CVE-2026-30783: RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) allows Privilege Abuse.
This vulnerability is associated with program files src/rendezvousmediator.Rs, src/hbbshttp/sync.Rs and program routines API sync loop, api-server config handling.
This issue affects RustDesk Client: through 1.4.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Move enforcement to server side: implement ACL and admin-command enforcement in the server (api-server) rather than relying on client-side enforcement to prevent clients from ignoring policies.
RustDesk (server-side enforcement; relates to Client signaling, API sync loop, config management modules) enforcement_location = server - Configuration
Require Signed Session Authorization Tokens for session establishment and API calls—validate signed tokens on the server to prevent orphaned API channels and clients ignoring admin commands and ACL policies.
RustDesk session authorization (api-server / client session handling) session_authorization_tokens = signed
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30783?
CVE-2026-30783 is considered a high severity vulnerability due to its potential for privilege abuse through the orphaning of API channels.
How do I fix CVE-2026-30783?
To fix CVE-2026-30783, users should upgrade the RustDesk Client to version 1.4.6 or later, which addresses the identified vulnerability.
What types of systems are affected by CVE-2026-30783?
CVE-2026-30783 affects the RustDesk Client running on Windows, MacOS, Linux, iOS, Android, and WebClient platforms.
What happens if CVE-2026-30783 is exploited?
If exploited, CVE-2026-30783 could allow an attacker to bypass admin commands and access control policies, leading to unauthorized actions.
Is there a way to mitigate CVE-2026-30783 without upgrading?
There are no known effective mitigations for CVE-2026-30783 without upgrading the RustDesk Client to a patched version.