CVE-2026-30784: RustDesk Server Privilege Escalation Flaw

CVE-2026-30784 Overview

CVE-2026-30784 is a critical Missing Authorization and Missing Authentication for Critical Function vulnerability affecting RustDesk Server components. This security flaw exists in the self-hosted RustDesk Server infrastructure, specifically targeting the Rendezvous server (hbbs) and Relay server (hbbr) modules. The vulnerability allows unauthenticated attackers to abuse privileged functionality through network-accessible endpoints, potentially compromising the entire remote desktop infrastructure.

The vulnerability is associated with program files src/rendezvous_server.rs and src/relay_server.rs, specifically affecting the handle_punch_hole_request() function, RegisterPeer handler, and relay forwarding routines. Successful exploitation enables attackers to perform privilege abuse operations without proper authorization checks.

Critical Impact

Unauthenticated network attackers can exploit missing authorization controls in RustDesk Server's core communication modules to perform privilege abuse, potentially gaining unauthorized access to remote desktop sessions and relay infrastructure.

Affected Products

• RustDesk Server (rustdesk-server) through version 1.7.5
• RustDesk Server Pro (rustdesk-server-pro) through version 1.1.15
• All server platforms running hbbs (Rendezvous server) and hbbr (Relay server) modules

Discovery Timeline

• 2026-03-05 - CVE-2026-30784 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-30784

Vulnerability Analysis

This vulnerability stems from CWE-306 (Missing Authentication for Critical Function), where critical server-side functions fail to verify that requests originate from authenticated and authorized sources. The RustDesk Server architecture relies on the Rendezvous server (hbbs) to facilitate peer discovery and hole-punching, while the Relay server (hbbr) handles traffic forwarding when direct connections fail.

The affected routines—handle_punch_hole_request(), RegisterPeer handler, and relay forwarding mechanisms—process incoming requests without adequate authentication validation. This architectural oversight allows remote attackers to interact with privileged server functionality, potentially registering rogue peers, manipulating hole-punching operations, or abusing relay forwarding capabilities.

The network-accessible nature of these services combined with the lack of authorization controls creates a significant attack surface for organizations running self-hosted RustDesk infrastructure.

Root Cause

The root cause is the absence of authentication and authorization validation in critical server-side request handlers within the RustDesk Server codebase. The handle_punch_hole_request() function in src/rendezvous_server.rs and the RegisterPeer handler process incoming network requests without verifying the identity or privileges of the requesting entity. Similarly, relay forwarding in src/relay_server.rs lacks proper access controls, allowing unauthorized traffic manipulation.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker with network access to the RustDesk Server infrastructure can craft malicious requests targeting the vulnerable endpoints:

1. Peer Registration Abuse: Attackers can register malicious peers through the RegisterPeer handler without authentication, potentially impersonating legitimate clients or injecting rogue endpoints into the peer discovery system.

2. Hole-Punching Manipulation: The handle_punch_hole_request() function can be abused to manipulate NAT traversal operations, potentially redirecting connections or facilitating man-in-the-middle scenarios.

3. Relay Forwarding Abuse: Unauthorized access to relay forwarding functionality enables attackers to route traffic through the relay server without proper authorization, potentially for data exfiltration or to pivot within the network.

The vulnerability does not require prior authentication, making it accessible to any attacker with network connectivity to the affected servers.

Detection Methods for CVE-2026-30784

Indicators of Compromise

• Unexpected peer registrations in RustDesk Server logs from unknown IP addresses
• Anomalous hole-punching requests or connection patterns in hbbs server logs
• Unusual relay traffic volumes or connections to/from unauthorized endpoints through hbbr
• Authentication failures or bypass attempts logged in server diagnostics

Detection Strategies

• Monitor network traffic to hbbs and hbbr services for unusual request patterns or high volumes of registration attempts
• Implement network-level intrusion detection rules to identify exploitation attempts targeting RustDesk Server protocols
• Review server logs for unauthorized peer registration events or relay forwarding anomalies
• Deploy behavioral analytics to detect privilege abuse patterns in RustDesk infrastructure

Monitoring Recommendations

• Enable verbose logging on RustDesk Server components to capture detailed request information
• Implement network segmentation to limit exposure of hbbs and hbbr services to trusted networks
• Configure alerting for unexpected connection attempts or configuration changes
• Regularly audit registered peers and active relay sessions for unauthorized entries

How to Mitigate CVE-2026-30784

Immediate Actions Required

• Update RustDesk Server to a patched version beyond 1.7.5 when available
• Update RustDesk Server Pro to a patched version beyond 1.1.15 when available
• Implement network-level access controls to restrict connectivity to hbbs and hbbr services
• Review and audit existing peer registrations for unauthorized entries

Patch Information

Organizations should monitor official RustDesk channels for security patches addressing this vulnerability. The affected versions are RustDesk Server through 1.7.5 and RustDesk Server Pro through 1.1.15. Consult the RustDesk Self-Hosting Guide for deployment and update instructions. Additional technical details may be available through the security documentation.

Workarounds

• Deploy firewall rules to restrict access to RustDesk Server ports (default 21115-21119) to trusted IP ranges only
• Implement a VPN or zero-trust network architecture to control access to self-hosted RustDesk infrastructure
• Consider temporarily disabling public-facing RustDesk Server instances until patches are applied
• Use network monitoring to detect and block exploitation attempts targeting vulnerable endpoints

# Example firewall configuration to restrict RustDesk Server access
# Allow only trusted IP ranges to access hbbs/hbbr services
iptables -A INPUT -p tcp --dport 21115:21119 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 21116 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 21115:21119 -j DROP
iptables -A INPUT -p udp --dport 21116 -j DROP