CVE-2026-30796: RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync
Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks.
The client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbshttp/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book.
This vulnerability is associated with program files src/hbbshttp/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password).
This issue affects RustDesk Client: through 1.4.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rustdesk-clientto a version that resolves this vulnerability.Fixed in 1.4.8Patch CVE-2026-30797 - Compensating control
Assume the address-book credential may be exposed if a rogue/re-homed API server (CVE-2026-30797) is in place; prevent the client from communicating with untrusted API endpoints by restricting/allowlisting the RustDesk API server endpoints at the network layer (e.g., firewall/ACL) so only the legitimate API endpoint can be reached.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30796?
CVE-2026-30796 is considered a high-severity vulnerability due to the potential for sensitive information exposure.
How do I fix CVE-2026-30796?
To fix CVE-2026-30796, upgrade to the latest version of RustDesk Server Pro where the vulnerability is patched.
What are the risks associated with CVE-2026-30796?
The risks associated with CVE-2026-30796 include the possibility of unauthorized access to sensitive information during transmission.
Who is affected by CVE-2026-30796?
CVE-2026-30796 affects users of RustDesk Server Pro versions up to and including 1.7.5 on Windows, MacOS, and Linux.
What type of attacks can exploit CVE-2026-30796?
CVE-2026-30796 can be exploited using sniffing attacks, where an attacker can intercept cleartext transmissions of sensitive data.