CVE-2026-67294 FreeRDP before 3.29.0 TLS Certificate EKU Bypass
FreeRDP clients may accept invalid server certificates due to flawed EKU validation, allowing man-in-the-middle attacks in environments relying on certificate purpose separation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-67294?
CVE-2026-67294 is a critical vulnerability in Freerdp Freerdp, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the RDP server certificate. In environments relying on EKU separation between client and server certificates, this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose validation.
Weakness: CWE-295
Which versions are affected by CVE-2026-67294?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-67294?
Upgrade to a fixed version.
Is CVE-2026-67294 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67294 exists.
Other vulnerabilities in Freerdp Freerdp
- CVE-2021-37594 Other in n/a
- CVE-2021-37595 Other in n/a
- CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Sources
Also known as DEBIAN-CVE-2026-67294, GHSA-89c6-jjrw-96h4, GHSA-v6mf-3jqv-cgr7, UBUNTU-CVE-2026-67294.