CVE-2026-30794: RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the automatic fallback retry that calls danger_accept_invalid_certs(true). Ensure the code does not set danger_accept_invalid_certs to true under any retry or fallback path.
RustDesk Client HTTP client (src/hbbs_http/http_client.Rs) danger_accept_invalid_certs = false - Configuration
Treat TLS handshake failures as fatal: do not retry the connection with certificate validation disabled. Abort the connection on handshake failure instead of falling back to insecure acceptance.
RustDesk Client TLS transport modules TLS handshake failure handling = fatal
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30794?
CVE-2026-30794 is classified as a high-severity vulnerability due to its potential for enabling Adversary in the Middle (AiTM) attacks.
How do I fix CVE-2026-30794?
To mitigate CVE-2026-30794, update the RustDesk Client to version 1.4.6 or later where the TLS certificate validation flaw has been addressed.
What platforms are affected by CVE-2026-30794?
CVE-2026-30794 affects RustDesk Client on Windows, MacOS, Linux, iOS, and Android.
What type of vulnerability is CVE-2026-30794?
CVE-2026-30794 is a vulnerability related to improper certificate validation which allows the acceptance of invalid TLS certificates.
What are the risks associated with CVE-2026-30794?
The risks associated with CVE-2026-30794 include exposure to Man-in-the-Middle attacks where an attacker can intercept and alter communications.