CVE-2026-30791 RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation

What is CVE-2026-30791?

CVE-2026-30791 is a high-severity vulnerability in rustdesk-client RustDesk Client, published on 5 Mar 2026.

Official description

Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Config import, URI scheme handler, CLI --config modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files flutter/lib/common.Dart, hbb_common/src/config.Rs and program routines parseRustdeskUri(), importConfig().

This issue affects RustDesk Client: through 1.4.5.

Weakness: CWE-684, CWE-327

Which versions are affected by CVE-2026-30791?

It affects 1 product.

Products include Rustdesk Rustdesk.

How do I fix CVE-2026-30791?

No fix has been published for CVE-2026-30791 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-30791 being exploited?

There is no known exploitation of CVE-2026-30791 in the wild and no public exploit code.

Other vulnerabilities in rustdesk-client RustDesk Client

• CVE-2024-25140 Misconfiguration in n/a Critical 9.8
• CVE-2026-30793 RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation Critical 9.3
• CVE-2026-30797 RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server Critical 9.3
• CVE-2026-30795 RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure High 8.7
• CVE-2026-30792 RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mpxj-6c39-w4rr.