CVE-2026-30797 RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server
Attackers can silently re-home RustDesk clients to malicious servers via crafted URIs, bypassing authorization checks and potentially intercepting remote control sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-30797?
CVE-2026-30797 is a critical missing authorization vulnerability in rustdesk-client RustDesk Client, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, config import modules) allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files flutter/lib/common.Dart and program routines importConfig() via URI handler.
This issue affects RustDesk Client: through 1.4.5.
Which versions are affected by CVE-2026-30797?
It affects 1 product.
Products include Rustdesk Rustdesk.
How do I fix CVE-2026-30797?
No fix has been published for CVE-2026-30797 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-30797 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30797 exists.
Other vulnerabilities in rustdesk-client RustDesk Client
- CVE-2024-25140 Misconfiguration in n/a
- CVE-2026-30793 RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
- CVE-2026-30791 RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation
- CVE-2026-30795 RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure
- CVE-2026-30792 RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings
Sources
Also known as GHSA-9h94-q24v-4v27.