CVE-2026-30785 RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)
Attackers can decrypt local passwords using a world-readable machine ID and fixed nonce, exposing sensitive credentials in RustDesk Client.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-30785?
CVE-2026-30785 is a high-severity vulnerability in rustdesk-client RustDesk Client, published on 5 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbb_common on Windows, MacOS, Linux (Password security module, config encryption, machine UID modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files hbb_common/src/password_security.Rs, hbb_common/src/config.Rs, hbb_common/src/lib.Rs (get_uuid), machine-uid/src/lib.Rs and program routines symmetric_crypt(), encrypt_str_or_original(), decrypt_str_or_original(), get_uuid(), get_machine_id().
This issue affects RustDesk Client: through 1.4.5.
Which versions are affected by CVE-2026-30785?
It affects 1 product.
Products include Rustdesk Rustdesk.
How do I fix CVE-2026-30785?
No fix has been published for CVE-2026-30785 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-30785 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30785 exists.
Other vulnerabilities in rustdesk-client RustDesk Client
- CVE-2024-25140 Misconfiguration in n/a
- CVE-2026-30793 RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
- CVE-2026-30797 RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server
- CVE-2026-30791 RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation
- CVE-2026-30795 RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure
Sources
Also known as GHSA-v738-924g-mm67.