CVE-2026-30790: RustDesk Server Auth Bypass Vulnerability

CVE-2026-30790 Overview

CVE-2026-30790 is a critical authentication vulnerability affecting RustDesk Server Pro and RustDesk Server (OSS) that enables password brute forcing attacks due to improper restriction of excessive authentication attempts combined with the use of password hashing with insufficient computational effort. The vulnerability exists in the peer authentication and API login modules across Windows, MacOS, and Linux platforms.

The flaw is specifically associated with program files src/server/connection.rs and program routines responsible for salt/challenge generation and the SHA256(SHA256(pwd+salt)+challenge) verification mechanism. This weak authentication scheme allows attackers to perform rapid brute force attacks against user credentials without being rate-limited or locked out.

Critical Impact

Remote attackers can brute force passwords without restriction, potentially gaining unauthorized access to RustDesk remote desktop sessions and compromising all connected systems.

Affected Products

• RustDesk Server Pro through version 1.7.5 on Windows, MacOS, and Linux
• RustDesk Server (OSS) through version 1.1.15 on Windows, MacOS, and Linux
• Peer authentication and API login modules

Discovery Timeline

• 2026-03-05 - CVE-2026-30790 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-30790

Vulnerability Analysis

This vulnerability combines two distinct weaknesses classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts). The RustDesk Server authentication mechanism fails to implement adequate controls to prevent automated password guessing attacks against the peer authentication and API login interfaces.

The authentication flow utilizes a challenge-response mechanism where the server generates a salt and challenge value, and the client must respond with SHA256(SHA256(password+salt)+challenge). While this approach provides some protection against replay attacks, it does not address the fundamental issue of unlimited authentication attempts.

The use of SHA256 for password hashing, while cryptographically secure for integrity purposes, is computationally efficient by design. This characteristic makes it unsuitable for password storage and verification, as modern hardware can compute billions of SHA256 hashes per second, significantly accelerating brute force attacks.

Root Cause

The root cause stems from two architectural weaknesses in the authentication system:

1. Missing Rate Limiting: The src/server/connection.rs file lacks implementation of authentication attempt throttling, account lockout policies, or exponential backoff mechanisms that would slow down or prevent brute force attacks.

2. Computationally Weak Hashing: The double SHA256 hashing scheme SHA256(SHA256(pwd+salt)+challenge) uses a fast cryptographic hash function rather than a password-specific key derivation function designed to be computationally expensive (such as Argon2, bcrypt, or PBKDF2).

Attack Vector

The vulnerability is exploitable remotely over the network without requiring any prior authentication or user interaction. An attacker can target the peer authentication or API login endpoints and submit unlimited authentication requests at high speed.

The attack flow involves:

1. Connecting to the RustDesk Server authentication endpoint
2. Receiving the server-generated salt and challenge values
3. Computing password hash candidates using the disclosed algorithm
4. Submitting authentication attempts without restriction until valid credentials are found
5. Gaining unauthorized access to remote desktop sessions

Attackers can leverage password dictionaries, credential stuffing from previous breaches, or systematic brute force enumeration. The computational efficiency of SHA256 enables testing millions of password candidates per second on commodity hardware.

Detection Methods for CVE-2026-30790

Indicators of Compromise

• Unusually high volume of authentication failures from single or multiple IP addresses targeting RustDesk Server
• Rapid succession of login attempts against peer authentication or API login endpoints
• Connection patterns showing systematic credential testing behavior
• Multiple failed authentication events followed by a successful login (potential compromise indicator)
• Anomalous network traffic to RustDesk Server ports with authentication-related payloads

Detection Strategies

• Implement network-level monitoring for excessive connection attempts to RustDesk Server authentication services
• Deploy log analysis rules to detect authentication failure spikes exceeding normal baselines
• Configure SIEM alerting for distributed brute force patterns originating from multiple source IPs
• Monitor for credential stuffing attack signatures using known breach credential patterns

Monitoring Recommendations

• Enable detailed authentication logging on RustDesk Server instances to capture source IPs and timestamps
• Establish baseline metrics for normal authentication failure rates and alert on deviations
• Implement network flow analysis to identify high-frequency connection patterns to authentication endpoints
• Consider deploying honeypot credentials to detect active exploitation attempts

How to Mitigate CVE-2026-30790

Immediate Actions Required

• Upgrade RustDesk Server Pro to a version newer than 1.7.5 when a patched release becomes available
• Upgrade RustDesk Server (OSS) to a version newer than 1.1.15 when a patched release becomes available
• Implement network-level rate limiting using firewall rules or reverse proxy configurations
• Enforce strong, unique passwords for all RustDesk user accounts to increase brute force resistance
• Consider placing RustDesk Server behind a VPN or other network access control mechanism

Patch Information

Organizations should monitor the GitHub RustDesk Repository for security updates addressing this vulnerability. Additional technical details may be available in the security disclosure documentation. Security resources are also available at Vulsec.

Workarounds

• Deploy a Web Application Firewall (WAF) or reverse proxy with rate limiting capabilities in front of RustDesk Server
• Configure firewall rules to limit the rate of new connections to RustDesk authentication ports per source IP
• Implement IP-based access control lists to restrict authentication endpoints to trusted network ranges
• Enable multi-factor authentication if supported by your deployment to add an additional security layer
• Monitor authentication logs and implement automated IP blocking for sources exceeding failure thresholds

# Example iptables rate limiting configuration for RustDesk Server
# Limit new connections to 10 per minute per source IP
iptables -A INPUT -p tcp --dport 21115 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 21115 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP
iptables -A INPUT -p tcp --dport 21116 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 21116 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP