CVE-2026-30783: RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies

Published Mar 5, 2026
·
Updated

A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) allows Privilege Abuse.

This vulnerability is associated with program files src/rendezvousmediator.Rs, src/hbbshttp/sync.Rs and program routines API sync loop, api-server config handling.

This issue affects RustDesk Client: through 1.4.8.

Affected Software

7 affected components
rustdesk/rustdesk-client<=1.4.5
All of the following
RustDesk RustDesk<=1.4.5
Any of the following
Apple iPhone OS
Apple macOS
Google Android
Linux Linux kernel
Microsoft Windows

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Move enforcement to server side: implement ACL and admin-command enforcement in the server (api-server) rather than relying on client-side enforcement to prevent clients from ignoring policies.

    RustDesk (server-side enforcement; relates to Client signaling, API sync loop, config management modules) enforcement_location = server
  2. Configuration

    Require Signed Session Authorization Tokens for session establishment and API calls—validate signed tokens on the server to prevent orphaned API channels and clients ignoring admin commands and ACL policies.

    RustDesk session authorization (api-server / client session handling) session_authorization_tokens = signed

Event History

Mar 5, 2026
CVE Published
via MITRE·03:52 PM
Data Sourced
via MITRE·03:52 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-30783?

CVE-2026-30783 is considered a high severity vulnerability due to its potential for privilege abuse through the orphaning of API channels.

2

How do I fix CVE-2026-30783?

To fix CVE-2026-30783, users should upgrade the RustDesk Client to version 1.4.6 or later, which addresses the identified vulnerability.

3

What types of systems are affected by CVE-2026-30783?

CVE-2026-30783 affects the RustDesk Client running on Windows, MacOS, Linux, iOS, Android, and WebClient platforms.

4

What happens if CVE-2026-30783 is exploited?

If exploited, CVE-2026-30783 could allow an attacker to bypass admin commands and access control policies, leading to unauthorized actions.

5

Is there a way to mitigate CVE-2026-30783 without upgrading?

There are no known effective mitigations for CVE-2026-30783 without upgrading the RustDesk Client to a patched version.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203