CVE-2026-67289: FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by httpproxyconnect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.29.0 - Compensating control
If you cannot patch immediately, mitigate exposure by ensuring clients do not connect through untrusted/malicious RDP servers (restrict which RDP servers can be reached) to prevent attacker-controlled RDP redirection TargetNetAddress values being sent.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67289?
CVE-2026-67289 has a critical severity rating of 9.3.
How do I fix CVE-2026-67289?
To fix CVE-2026-67289, upgrade FreeRDP to version 3.29.0 or later.
What kind of vulnerability is CVE-2026-67289?
CVE-2026-67289 is an HTTP Proxy Request Injection vulnerability.
Which versions of FreeRDP are affected by CVE-2026-67289?
FreeRDP versions 3.28.0 and earlier are affected by CVE-2026-67289.
What is the impact of CVE-2026-67289?
CVE-2026-67289 allows an attacker to execute injection attacks through unvalidated RDP redirection in the TargetNetAddress field.