CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
A malicious RDP server can inject arbitrary headers into HTTP proxy requests via crafted redirection data, requiring proxy usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-67289?
CVE-2026-67289 is a critical vulnerability in Freerdp Freerdp, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.
Weakness: CWE-113
Which versions are affected by CVE-2026-67289?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-67289?
Upgrade to a fixed version.
Is CVE-2026-67289 being exploited?
There is no known exploitation of CVE-2026-67289 in the wild and no public exploit code.
Other vulnerabilities in Freerdp Freerdp
Sources
Also known as DEBIAN-CVE-2026-67289, GHSA-3x8f-6ffv-v2wc, GHSA-mwwh-mhp9-q7vm, UBUNTU-CVE-2026-67289.