CVE-2026-30785: RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbbcommon on Windows, MacOS, Linux (Password security module, config encryption, machine UID modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files hbbcommon/src/passwordsecurity.Rs, hbbcommon/src/config.Rs, hbbcommon/src/lib.Rs (getuuid), machine-uid/src/lib.Rs and program routines symmetriccrypt(), encryptstrororiginal(), decryptstrororiginal(), getuuid(), getmachineid().
This issue affects RustDesk Client: through 1.4.5.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30785?
CVE-2026-30785 is classified as a high severity vulnerability due to its potential impact on the confidentiality and integrity of local passwords.
How do I fix CVE-2026-30785?
To fix CVE-2026-30785, update the RustDesk Client to version 1.4.6 or later, which addresses the vulnerabilities.
What versions of RustDesk are affected by CVE-2026-30785?
RustDesk Client versions up to and including 1.4.5 are affected by CVE-2026-30785.
What are the main issues associated with CVE-2026-30785?
CVE-2026-30785 involves improper encryption of local passwords and insufficient computational effort in password hashing.
Can CVE-2026-30785 be exploited remotely?
CVE-2026-30785 primarily affects local system security rather than remote exploitation, but it can compromise user credentials.