CVE-2026-30792: RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Strategy sync, HTTP API client, config options engine modules) allows Application API Message Manipulation via Man-in-the-Middle.
This vulnerability is associated with program files src/hbbshttp/sync.Rs, hbbcommon/src/config.Rs and program routines Strategy merge loop in sync.Rs, Config::setoptions().
This issue affects RustDesk Client: through 1.4.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enforce runtime toggle checks so that strategy payloads cannot bypass local security settings (as described: Enforce runtime toggle checks).
RustDesk Client runtime toggle checks = enabled - Configuration
Implement payload signing with server private key and verify signatures in the client; update the Strategy merge loop in sync.Rs and Config::set_options() to require and validate signed payloads before merging.
RustDesk Client (strategy sync module: src/hbbs_http/sync.Rs; hbb_common/src/config.Rs) payload signing / signature verification = enabled (payloads signed with server private key) - Configuration
Modify the Strategy merge loop in sync.Rs and Config::set_options() to stop blindly merging unauthenticated strategy payloads and ensure local security settings are enforced before applying remote options.
src/hbbs_http/sync.Rs; hbb_common/src/config.Rs Strategy merge behavior = reject unauthenticated strategy payloads
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30792?
CVE-2026-30792 is considered a critical vulnerability due to its ability to bypass local security settings.
What are the affected versions for CVE-2026-30792?
CVE-2026-30792 affects RustDesk Client versions up to and including 1.4.5.
How do I fix CVE-2026-30792?
To fix CVE-2026-30792, upgrade to a version of RustDesk Client that is above 1.4.5.
What types of systems are impacted by CVE-2026-30792?
CVE-2026-30792 impacts RustDesk Client on multiple platforms including Windows, MacOS, Linux, iOS, Android, and WebClient.
What is the main issue caused by CVE-2026-30792?
CVE-2026-30792 allows unauthenticated strategy payloads to be blindly merged, compromising application security.