CVE-2026-30783 RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies
Attackers can orphan the API channel to bypass admin commands and ACL policies in RustDesk Client, requiring an upgrade to remediate.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-30783?
CVE-2026-30783 is a medium-severity vulnerability in rustdesk-client RustDesk Client, published on 5 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) allows Privilege Abuse.
This vulnerability is associated with program files src/rendezvous_mediator.Rs, src/hbbs_http/sync.Rs and program routines API sync loop, api-server config handling.
This issue affects RustDesk Client: through 1.4.8.
Which versions are affected by CVE-2026-30783?
It affects 1 product.
Products include Rustdesk Rustdesk.
How do I fix CVE-2026-30783?
No fix has been published for CVE-2026-30783 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-30783 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30783 exists.
Other vulnerabilities in rustdesk-client RustDesk Client
- CVE-2024-25140 Misconfiguration in n/a
- CVE-2026-30793 RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
- CVE-2026-30797 RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server
- CVE-2026-30791 RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation
- CVE-2026-30795 RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure
Sources
Also known as GHSA-f8r5-ghjf-q2pv.