CVE-2026-30785: RustDesk Client Information Disclosure

CVE-2026-30785 Overview

CVE-2026-30785 is a high-severity vulnerability affecting RustDesk Client versions through 1.4.5. The vulnerability combines two critical weakness categories: Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) and Use of Password Hash With Insufficient Computational Effort. These flaws exist within the password security module, configuration encryption, and machine UID modules of the RustDesk client, enabling attackers to retrieve embedded sensitive data from affected systems.

The vulnerability affects multiple core components including hbb_common/src/password_security.rs, hbb_common/src/config.rs, hbb_common/src/lib.rs, and machine-uid/src/lib.rs. Critical program routines such as symmetric_crypt(), encrypt_str_or_original(), decrypt_str_or_original(), get_uuid(), and get_machine_id() are directly implicated.

Critical Impact

Local attackers with low privileges can exploit weak cryptographic implementations to extract sensitive configuration data, passwords, and machine identifiers from RustDesk Client installations across Windows, MacOS, and Linux platforms.

Affected Products

• RustDesk Client through version 1.4.5 on Windows
• RustDesk Client through version 1.4.5 on MacOS
• RustDesk Client through version 1.4.5 on Linux

Discovery Timeline

• 2026-03-05 - CVE-2026-30785 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-30785

Vulnerability Analysis

This vulnerability stems from fundamental weaknesses in how RustDesk Client handles cryptographic operations and password security. The implementation uses password hashing mechanisms with insufficient computational effort, making stored credentials susceptible to brute-force attacks and rainbow table lookups. Combined with prototype pollution issues, attackers can manipulate object prototypes to access or modify sensitive data structures within the application.

The vulnerability requires local access to the system, meaning an attacker must have some level of existing access to the target machine. However, only low privileges are required to exploit the flaw, and no user interaction is necessary. The impact is primarily on confidentiality, with high potential for sensitive data exposure both within the vulnerable system and connected subsequent systems.

Root Cause

The root cause lies in CWE-257: Storing Passwords in a Recoverable Format. The RustDesk Client stores passwords and sensitive configuration data using encryption methods that can be reversed or cracked due to insufficient computational complexity. The symmetric_crypt() function and related encryption routines in the hbb_common module do not employ adequately strong algorithms or key derivation functions.

Additionally, the machine UID generation routines (get_uuid() and get_machine_id()) may expose predictable or recoverable identifiers that can be leveraged to decrypt stored configuration data.

Attack Vector

The attack vector is local, requiring an attacker to have access to the target system. Once local access is obtained, the attacker can:

1. Access RustDesk configuration files containing encrypted credentials
2. Exploit the weak encryption implementation to decrypt sensitive data
3. Extract passwords, connection credentials, and machine identifiers
4. Potentially pivot to connected remote systems using recovered credentials

The vulnerability in the encrypt_str_or_original() and decrypt_str_or_original() functions allows attackers to reverse the encryption process due to the predictable nature of the cryptographic implementation. Technical details regarding the specific exploitation methodology can be found in the Google Document Overview and community discussions on GitHub RustDesk Discussion #9229.

Detection Methods for CVE-2026-30785

Indicators of Compromise

• Unauthorized access to RustDesk configuration files located in user profile directories
• Unexpected reads of hbb_common password security files or config files
• Anomalous process activity attempting to access machine UID or UUID values
• Evidence of credential extraction tools targeting RustDesk-specific file paths

Detection Strategies

• Monitor file access patterns to RustDesk configuration directories for unusual read operations
• Implement endpoint detection rules to identify processes querying machine UID or RustDesk-specific encryption routines
• Deploy behavioral analytics to detect credential harvesting activities post-exploitation
• Audit local user accounts for privilege escalation attempts that may precede exploitation

Monitoring Recommendations

• Enable detailed file system auditing on RustDesk installation and configuration directories
• Configure SIEM rules to correlate local access events with RustDesk configuration file reads
• Implement application allowlisting to detect unauthorized tools accessing RustDesk data
• Review authentication logs for connections originating from potentially compromised endpoints

How to Mitigate CVE-2026-30785

Immediate Actions Required

• Upgrade RustDesk Client to the latest version beyond 1.4.5 if a patched version is available
• Rotate all passwords and credentials stored within RustDesk Client configurations
• Review and audit all systems where RustDesk Client is deployed for signs of compromise
• Restrict local access to systems running vulnerable RustDesk Client versions

Patch Information

At the time of publication, organizations should monitor the official RustDesk project for security updates addressing this vulnerability. Review the GitHub RustDesk Discussion #4979 and GitHub RustDesk Discussion #9229 for community updates and potential fixes. The VulSec Security Blog may also contain additional remediation guidance.

Workarounds

• Implement strict access controls to limit which users can access RustDesk configuration files
• Consider deploying RustDesk in isolated network segments to reduce lateral movement risk
• Use external password managers instead of relying on RustDesk's built-in credential storage
• Monitor and restrict local admin privileges on systems running RustDesk Client

# Restrict access to RustDesk configuration directory (Linux example)
chmod 700 ~/.config/rustdesk
chown $(whoami):$(whoami) ~/.config/rustdesk/*