CVE-2026-30798: RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload
Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop, strategy processing modules) allows Protocol Manipulation.
This vulnerability is associated with program files src/hbbshttp/sync.Rs and program routines stop-service handler in heartbeat loop.
This issue affects RustDesk Client: through 1.4.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the remote kill ('stop-service') logic from src/hbbs_http/sync.Rs stop-service handler to prevent the client from accepting unauthenticated stop-service commands via the heartbeat/strategy payloads.
RustDesk Client (src/hbbs_http/sync.Rs, stop-service handler) remote kill logic = remove - Configuration
Require and verify cryptographic signatures on strategy/heartbeat payloads and enforce time-limited expiry checks so that stop-service or other strategy commands are accepted only when accompanied by valid, unexpired signatures.
RustDesk Client (heartbeat sync loop / strategy processing modules) strategy payload authentication = require time-limited signed payloads
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30798?
CVE-2026-30798 is classified as a high severity vulnerability due to its impact on the RustDesk Client's security and the potential for unauthorized command execution.
How do I fix CVE-2026-30798?
To mitigate CVE-2026-30798, users should update the RustDesk Client to the latest version beyond 1.4.5, which addresses this security vulnerability.
What platforms are affected by CVE-2026-30798?
CVE-2026-30798 affects the RustDesk Client on multiple platforms, including Windows, MacOS, Linux, iOS, and Android.
What is the nature of the vulnerability in CVE-2026-30798?
CVE-2026-30798 involves unauthenticated command execution due to insufficient verification of data authenticity in the RustDesk Client.
Is there a known exploit for CVE-2026-30798?
While a specific exploit for CVE-2026-30798 may not be publicly available, the nature of the vulnerability poses a significant risk that could be exploited by attackers.