CVE-2026-109953: FreeRDP Information Disclosure Vulnerability

CVE-2026-109953 Overview

CVE-2026-109953 is an insufficiently protected credentials vulnerability [CWE-522] affecting FreeRDP versions 3.0.0 through 3.31.x. The /restricted-admin option fails to suppress Credential Security Support Provider (CredSSP) credential delegation. As a result, FreeRDP sends the user's cleartext password to the Remote Desktop Protocol (RDP) server instead of operating in the intended restricted admin mode. A compromised or man-in-the-middle (MITM) destination host can decode the TSPasswordCreds structure and the Client Info Protocol Data Unit (PDU) to recover reusable administrative domain, username, and password values.

Critical Impact
Administrators who rely on /restricted-admin to prevent credential exposure instead leak plaintext domain credentials to any RDP endpoint they connect to.

Affected Products

FreeRDP 3.0.0 through 3.31.x (fixed in 3.32.0)
Applications and distributions bundling vulnerable FreeRDP 3 libraries
RDP client workflows that invoke the /restricted-admin command line flag

Discovery Timeline

2026-10-13 - CVE-2026-109953 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109953

Vulnerability Analysis

Restricted Admin mode is a Microsoft RDP feature that prevents the client from sending reusable credentials to the target server. Instead, the server receives a derived authentication artifact that cannot be replayed off-host. FreeRDP exposes this behavior through the /restricted-admin command line option.

In FreeRDP 3.0.0 through 3.31.x, selecting /restricted-admin does not suppress CredSSP credential delegation. The client proceeds through the standard CredSSP exchange and transmits the cleartext password inside the TSPasswordCreds structure. The password is additionally present in the Client Info PDU sent after the secure channel is established.

Any party that controls the destination host, or that can intercept the session before TLS validation succeeds, can decode these structures and recover administrative credentials. The failure undermines the sole security guarantee the flag is intended to provide.

Root Cause

The root cause is a missing enforcement check in the FreeRDP 3 authentication path. The /restricted-admin flag is parsed and acknowledged but does not switch the CredSSP flow to the restricted admin negotiation that omits password material. The client continues to populate TSPasswordCreds with the plaintext credential supplied by the user.

Attack Vector

Exploitation requires a user to initiate an RDP connection using /restricted-admin to an attacker-controlled or compromised host. The attacker then parses the CredSSP traffic server-side to extract the domain, username, and password. The recovered credentials are reusable against other systems in the domain, enabling lateral movement and privileged access. The attack vector is network-based and requires user interaction to launch the vulnerable client. See the GitHub Security Advisory and the VulnCheck Advisory on FreeRDP for protocol-level details.

Detection Methods for CVE-2026-109953

Indicators of Compromise

Outbound RDP sessions from Linux or cross-platform hosts running FreeRDP 3.0.0 through 3.31.x with the /restricted-admin flag present in process command lines.
RDP connections to hosts outside the organization's trusted RDP inventory, especially newly observed destinations.
Repeated successful authentications using the same administrative account across multiple servers shortly after a FreeRDP session with an untrusted host.

Detection Strategies

Inventory FreeRDP binaries across managed Linux, macOS, and Windows hosts and flag versions earlier than 3.32.0.
Alert on process executions of xfreerdp or wlfreerdp where the argument list contains /restricted-admin.
Correlate RDP client launches with subsequent authentication activity in Active Directory for the same account to detect credential reuse patterns.

Monitoring Recommendations

Ingest process command line telemetry from endpoints into a central data lake and build queries for FreeRDP invocations with sensitive flags.
Monitor RDP destination reputation and alert when restricted-admin sessions target hosts not on an approved allowlist.
Review Windows Security Event ID 4624 logon events for administrative accounts to identify unexpected reuse following FreeRDP activity.

How to Mitigate CVE-2026-109953

Immediate Actions Required

Upgrade FreeRDP to version 3.32.0 or later on every system where the client is installed.
Rotate credentials for any administrative account that was used with /restricted-admin against untrusted or externally hosted RDP endpoints.
Audit shell history, scripts, and automation pipelines for xfreerdp /restricted-admin invocations and update them after patching.

Patch Information

The FreeRDP project addressed the issue in release 3.32.0. The fix enforces the restricted admin negotiation so that TSPasswordCreds is not populated with the user's cleartext password when /restricted-admin is specified. Refer to the GitHub Security Advisory GHSA-jhxw-3hj9-9hqh for the complete patch metadata.

Workarounds

Avoid using /restricted-admin with FreeRDP 3.x prior to 3.32.0; use a patched build or an alternative RDP client that correctly implements restricted admin mode.
Restrict outbound RDP from workstations running vulnerable FreeRDP versions to a strict allowlist of trusted internal servers.
Use dedicated privileged access workstations and separate administrative accounts to limit the blast radius if credentials are exposed.

bash

# Verify installed FreeRDP version and upgrade
xfreerdp --version

# Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11

# Fedora / RHEL
sudo dnf upgrade freerdp

# Confirm patched version 3.32.0 or later is in use
xfreerdp --version | grep -E '3\.(3[2-9]|[4-9][0-9])'