CVE-2026-30798 RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload
An unauthenticated attacker can send a stop-service command via the heartbeat loop, causing a denial of service or bypassing security controls in RustDesk Client.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-30798?
CVE-2026-30798 is a high-severity missing authorization vulnerability in rustdesk-client RustDesk Client, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop, strategy processing modules) allows Protocol Manipulation.
This vulnerability is associated with program files src/hbbs_http/sync.Rs and program routines stop-service handler in heartbeat loop.
This issue affects RustDesk Client: through 1.4.8.
Which versions are affected by CVE-2026-30798?
It affects 1 product.
Products include Rustdesk Rustdesk.
How do I fix CVE-2026-30798?
No fix has been published for CVE-2026-30798 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-30798 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30798 exists.
Other vulnerabilities in rustdesk-client RustDesk Client
- CVE-2024-25140 Misconfiguration in n/a
- CVE-2026-30793 RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation
- CVE-2026-30797 RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server
- CVE-2026-30791 RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation
- CVE-2026-30795 RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure
Sources
Also known as GHSA-w793-gh7r-h7mx.