CVE-2026-30790: RustDesk Server Controls All Handshake Entropy (Salt/Challenge), Enabling Offline Brute-Force
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add and enforce server-side rate limiting on the /api login path to throttle repeated login attempts and slow offline brute-force attempts.
RustDesk Server Pro /api login path server-side rate limiting = enabled - Configuration
Implement SRP (Secure Remote Password) for mutual authentication on the /api login path, replacing the current fast double SHA256 proof construction.
RustDesk Server Pro /api login path authentication protocol = SRP (Secure Remote Password) - Configuration
Disable the automatic invalid-certificate downgrade behavior (referenced as CVE-2026-30794) so TLS certificate validation failures do not expose the login proof.
RustDesk TLS handling / automatic invalid-certificate downgrade automatic invalid-certificate downgrade = disabled - Compensating control
Block or restrict connections from RustDesk Client versions through 1.4.8 at the management /api login endpoint (for example deny access, require additional MFA, or place behind an access control) until clients using a fixed implementation are available.
- Operational
Modify RustDesk client source files src/client.rs and src/common.rs: update the routines handle_hash(), handle_login_from_ui(), and post_request_() to remove the fast double SHA256 proof over server-controlled salt/challenge and implement SRP or an equivalently secure mutual-authentication mechanism and/or a slow KDF to prevent offline recovery of credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30790?
CVE-2026-30790 is considered a high severity vulnerability due to its potential to allow offline brute-force attacks.
How do I fix CVE-2026-30790?
To fix CVE-2026-30790, users should upgrade RustDesk Server Pro to version 1.7.5 or later.
What systems are affected by CVE-2026-30790?
CVE-2026-30790 affects RustDesk Server Pro versions up to and including 1.7.5 and RustDesk Server versions up to and including 1.1.15.
What type of vulnerability is CVE-2026-30790?
CVE-2026-30790 is categorized as an improper restriction of excessive authentication attempts vulnerability.
Does CVE-2026-30790 affect password security?
Yes, CVE-2026-30790 poses risks to password security by using password hashing with insufficient computational effort.