CVE-2026-100388 Overview
CVE-2026-100388 is a missing authorization vulnerability [CWE-862] in RustDesk versions before 1.5.0. The flaw resides in the Cliprdr message handler on Linux and macOS builds. RustDesk fails to validate file transfer permissions on incoming file clipboard messages. Authenticated remote peers with disabled file transfer permissions can place files onto the host clipboard. The same peers can also retrieve copied files and contents from the process-wide clipboard cache. The vulnerability bypasses an explicit permission control that administrators configure to restrict file movement between sessions.
Critical Impact
Authenticated peers can push and pull files through the host clipboard even when file transfer permissions are explicitly disabled on the target.
Affected Products
- RustDesk for Linux, versions prior to 1.5.0
- RustDesk for macOS, versions prior to 1.5.0
- RustDesk builds with the unix-file-copy-paste feature enabled
Discovery Timeline
- 2026-09-25 - CVE-2026-100388 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-100388
Vulnerability Analysis
RustDesk is an open-source remote desktop application written in Rust. It supports bidirectional clipboard synchronization, including file clipboard content on Unix platforms through the unix-file-copy-paste feature. The server-side connection handler receives Cliprdr messages from connected peers and forwards them to the host clipboard subsystem.
In versions before 1.5.0, the handler in src/server/connection.rs processes incoming file clipboard messages without consulting the per-connection file transfer permission flag. A peer whose session was explicitly configured with file transfer disabled can still inject file references into the host clipboard. The peer can also issue FormatDataRequest and FileContentsRequest messages to pull cached clipboard files from the host process.
Root Cause
The root cause is a missing authorization check [CWE-862] on inbound Cliprdr messages in the Unix file copy-paste code path. The permission gate that governs file transfer operations was never applied to the clipboard message handler, leaving the file data request and file contents request subtypes unauthenticated against session policy.
Attack Vector
Exploitation requires an authenticated session to the RustDesk host. The attacker connects as a permitted peer whose profile has file transfer disabled, then sends crafted Cliprdr messages containing file descriptors or data requests. The host processes these messages, exposing clipboard-cached file contents or injecting attacker-supplied file references.
// Patch from src/server/connection.rs introducing the file_transfer_enabled() gate
} else if is_file_data_request(&clip)
&& crate::get_builtin_option(keys::OPTION_ONE_WAY_FILE_TRANSFER) == "Y"
{
// One-way file transfer: never serve this side's clipboard files to the peer.
} else if let Some(clip) = msg_2_clip(clip) {
#[cfg(target_os = "windows")]
{
self.send_to_cm(ipc::Data::ClipboardFile(clip));
}
#[cfg(feature = "unix-file-copy-paste")]
if crate::is_support_file_copy_paste(&self.lr.version)
&& self.file_transfer_enabled()
{
let mut out_msgs = vec![];
Source: RustDesk commit f299fb9
A new helper is_file_data_request classifies the message subtypes that must be gated:
pub fn is_file_data_request(msg: &Cliprdr) -> bool {
matches!(
msg.union,
Some(cliprdr::Union::FormatDataRequest(_)) | Some(cliprdr::Union::FileContentsRequest(_))
)
}
Source: RustDesk commit f299fb9
Detection Methods for CVE-2026-100388
Indicators of Compromise
- Running RustDesk server binaries on Linux or macOS with version strings below 1.5.0.
- Unexpected Cliprdr traffic from peer sessions configured without file transfer rights.
- Clipboard cache files appearing in the RustDesk process working directory outside of operator-initiated transfers.
Detection Strategies
- Inventory RustDesk installations across Unix endpoints and flag any version earlier than 1.5.0.
- Review RustDesk connection logs for peers that trigger file clipboard operations while assigned restricted permission profiles.
- Correlate clipboard-related syscalls on macOS and Linux hosts with active RustDesk peer identifiers.
Monitoring Recommendations
- Capture network metadata for RustDesk relay and direct connections to profile peers that transmit FormatDataRequest or FileContentsRequest messages.
- Monitor filesystem access by the RustDesk process to detect unexpected reads from clipboard cache directories.
- Alert on new or modified RustDesk binaries that are not sourced from the official distribution channel.
How to Mitigate CVE-2026-100388
Immediate Actions Required
- Upgrade all Linux and macOS RustDesk hosts to version 1.5.0 or later.
- Audit peer permission profiles and remove any peers that no longer require remote access.
- Rotate access credentials and permanent passwords used by the RustDesk server after upgrading.
Patch Information
The fix is implemented in RustDesk pull request #16333 and merged in commit f299fb9906006247863250d7dfaa016f29eef7a4. The change adds a file_transfer_enabled() check in src/server/connection.rs and introduces the is_file_data_request helper in src/clipboard_file.rs to enforce authorization before processing inbound file clipboard messages. Full advisory details are available in the VulnCheck Advisory for RustDesk.
Workarounds
- Disable the unix-file-copy-paste feature at build time if clipboard file transfer is not required.
- Enable the ONE_WAY_FILE_TRANSFER builtin option to prevent the host from serving clipboard files to peers.
- Restrict inbound RustDesk connections to known peer identifiers using network segmentation or firewall rules until the upgrade is complete.
# Verify installed RustDesk version on Linux or macOS
rustdesk --version
# Example: enforce one-way file transfer via builtin option before upgrading
# (set in the RustDesk server configuration)
ONE_WAY_FILE_TRANSFER=Y
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.