CVE-2026-30796 RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync

Medium 6.9 Published 5 Mar 2026 Updated 19 Jul 2026

RustDesk Client leaks the address book password in heartbeat syncs, allowing attackers with API control to access sensitive data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-30796?

CVE-2026-30796 is a medium-severity vulnerability in rustdesk-client RustDesk Client, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks.

The client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book.

This vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password).

This issue affects RustDesk Client: through 1.4.8.

Weakness: CWE-522

Which versions are affected by CVE-2026-30796?

It affects 1 product.

Products include Rustdesk Rustdesk Server.

How do I fix CVE-2026-30796?

No fix has been published for CVE-2026-30796 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-30796 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30796 exists.

CVE-2026-3598 RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption High 8.7

Sources

Also known as GHSA-v69h-c25q-f3jf.