CVE-2026-109244 Overview
CVE-2026-109244 is an insecure permissions vulnerability in FreeRDP's winpr-makecert utility affecting versions 2.0.0 through 3.32.0. The tool generates unencrypted private keys without applying owner-only file modes, leaving the resulting key material readable by any local user. Attackers on multi-user Unix hosts can harvest world-readable private keys or open the generated PFX files using the hard-coded default password. The flaw is tracked under CWE-732: Incorrect Permission Assignment for Critical Resource.
Critical Impact
Local users on shared Unix systems can read FreeRDP private keys and PFX bundles, compromising the confidentiality and integrity of RDP sessions and any services relying on those certificates.
Affected Products
- FreeRDP versions 2.0.0 through 3.31.x
- The winpr-makecert certificate generation utility
- Unix and Linux hosts where FreeRDP certificates are generated in shared directories
Discovery Timeline
- 2026-10-12 - CVE-2026-109244 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-109244
Vulnerability Analysis
The winpr-makecert utility ships with FreeRDP to generate X.509 certificates and corresponding private keys for RDP authentication and TLS termination. When invoked, the utility writes the private key file using default process umask settings instead of enforcing restrictive owner-only permissions. On a typical multi-user Unix host, this results in key files readable by every local account.
The utility also produces PFX (PKCS#12) bundles protected by a hard-coded default password. Even if a user applies stricter permissions after the fact, any PFX file still accessible to other users can be opened and the private key extracted without additional effort. Both failure modes expose private key material intended to authenticate RDP endpoints.
Root Cause
The root cause is twofold. First, winpr-makecert does not call chmod or equivalent syscalls to set 0600 on the private key output before writing sensitive material. Second, the PFX export routine uses a fixed default password instead of prompting the operator or requiring one via command-line input. Both design choices violate the least-privilege principle described in [CWE-732].
Attack Vector
Exploitation requires local access to a system where winpr-makecert has been used. An unprivileged attacker enumerates the filesystem for key files produced by the utility, reads the plaintext key directly if permissions are world-readable, or opens any accessible PFX file with the known default password. The attacker then reuses the stolen key to impersonate the RDP server, decrypt captured traffic, or pivot into services that trust the certificate.
No code example is available. See the GitHub Security Advisory GHSA-2jfv-j3wx-5cg4 and the VulnCheck Advisory on FreeRDP for additional technical context.
Detection Methods for CVE-2026-109244
Indicators of Compromise
- Private key files generated by winpr-makecert with world-readable or group-readable modes such as 0644 or 0664.
- PFX files produced by winpr-makecert residing in shared or user-accessible directories.
- Unexpected read access events against FreeRDP certificate directories by non-owner local accounts.
Detection Strategies
- Audit filesystem permissions across hosts that have FreeRDP installed, flagging any *.key, *.pem, or *.pfx files owned by the FreeRDP user but readable by others.
- Search shell history and process execution logs for invocations of winpr-makecert to identify when and where keys were produced.
- Correlate RDP authentication events with certificate fingerprints to detect reuse of leaked keys by unauthorized endpoints.
Monitoring Recommendations
- Enable Linux audit rules on directories that store FreeRDP certificates to log read access by non-owner UIDs.
- Monitor for file creation events matching the output patterns of winpr-makecert and verify that permissions are 0600.
- Alert on PFX files whose metadata indicates default password usage during import or inspection.
How to Mitigate CVE-2026-109244
Immediate Actions Required
- Upgrade FreeRDP to version 3.32.0 or later across all affected hosts.
- Rotate every private key and certificate previously generated by winpr-makecert on multi-user systems.
- Restrict permissions on existing FreeRDP key material to 0600 and move key stores out of world-readable paths.
Patch Information
The FreeRDP project addressed the issue in version 3.32.0. Details are published in the GitHub Security Advisory GHSA-2jfv-j3wx-5cg4. Distribution maintainers should backport the fix to supported branches and re-issue affected packages.
Workarounds
- Set a restrictive umask such as 0077 in the shell session before invoking winpr-makecert.
- Generate certificates on a single-user administrative host and transfer only the public certificate to shared systems.
- Replace PFX files produced with the default password by re-exporting the key material using openssl pkcs12 with a strong, operator-supplied password.
# Configuration example
umask 0077
winpr-makecert -rdp -path /root/freerdp-certs server
chmod 600 /root/freerdp-certs/server.key /root/freerdp-certs/server.pfx
chown root:root /root/freerdp-certs/server.key /root/freerdp-certs/server.pfx
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
