CVE-2026-3598 RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption
Attackers can retrieve embedded sensitive data from RustDesk Server Pro because config strings use reversible encoding instead of encryption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3598?
CVE-2026-3598 is a high-severity vulnerability in rustdesk-server-pro RustDesk Server Pro, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux (Config string generation, web console export modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program routines Config export/generation routines.
This issue affects RustDesk Server Pro: through 1.7.5.
Which versions are affected by CVE-2026-3598?
It affects 1 product.
Products include Rustdesk Rustdesk Server.
How do I fix CVE-2026-3598?
No fix has been published for CVE-2026-3598 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-3598 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3598 exists.
Other vulnerabilities in rustdesk-server-pro RustDesk Server Pro
Sources
Also known as GHSA-8f92-r334-42wm.