CVE-2026-67294: FreeRDP before 3.29.0 TLS Certificate EKU Bypass
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify(), when server-purpose (X509PURPOSESSLSERVER) verification fails, the code falls back to client-purpose and any-purpose verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the RDP server certificate. In environments relying on EKU separation between client and server certificates, this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose validation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67294?
The severity of CVE-2026-67294 is critical with a score of 9.3.
How does CVE-2026-67294 affect FreeRDP?
CVE-2026-67294 affects FreeRDP by improperly validating the EKU purpose of the peer certificate during client-side server TLS authentication.
How do I fix CVE-2026-67294?
To fix CVE-2026-67294, you should upgrade FreeRDP to version 3.29.0 or later.
What is the risk associated with CVE-2026-67294?
The risk associated with CVE-2026-67294 is rated at 84, indicating a significant threat to secure communications.
What is the impact of CVE-2026-67294 on confidentiality?
CVE-2026-67294 has a high impact on confidentiality as it allows potential attackers to bypass certificate validation.