CVE-2026-30791: RustDesk Client Cryptographic Vulnerability

CVE-2026-30791 Overview

CVE-2026-30791 is a Use of a Broken or Risky Cryptographic Algorithm vulnerability affecting the RustDesk Client across multiple platforms including Windows, MacOS, Linux, iOS, Android, and WebClient. The vulnerability exists in the configuration import mechanisms, specifically within the Config import, URI scheme handler, and CLI --config modules, allowing attackers to retrieve embedded sensitive data from configuration files.

The vulnerability is associated with program files flutter/lib/common.Dart and hbb_common/src/config.Rs, specifically within the parseRustdeskUri() and importConfig() routines. These functions handle the parsing and processing of configuration data without adequately protecting sensitive information through strong cryptographic measures.

Critical Impact

Attackers can exploit weak cryptographic protections to extract sensitive configuration data including credentials, connection details, and other embedded secrets from RustDesk Client installations across all supported platforms.

Affected Products

• RustDesk Client through version 1.4.5 on Windows
• RustDesk Client through version 1.4.5 on MacOS
• RustDesk Client through version 1.4.5 on Linux
• RustDesk Client through version 1.4.5 on iOS
• RustDesk Client through version 1.4.5 on Android
• RustDesk Client through version 1.4.5 WebClient

Discovery Timeline

• 2026-03-05 - CVE-2026-30791 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-30791

Vulnerability Analysis

This vulnerability stems from CWE-327 (Use of a Broken or Risky Cryptographic Algorithm). The RustDesk Client implements cryptographic protections for sensitive configuration data that do not meet current security standards. When users import configurations via URI scheme handlers or the CLI --config parameter, the application processes this data through routines that utilize weak cryptographic mechanisms.

The attack surface is network-accessible and requires no user interaction or prior authentication, making it particularly concerning for enterprise deployments where RustDesk configurations may contain credentials for accessing remote systems. An attacker who can intercept or obtain RustDesk configuration files or URIs can decrypt the embedded sensitive data with relatively low effort due to the weak cryptographic implementation.

Root Cause

The root cause lies in the cryptographic implementation within the parseRustdeskUri() and importConfig() functions located in flutter/lib/common.Dart and hbb_common/src/config.Rs. These routines use cryptographic algorithms or key derivation methods that are insufficient to protect the confidentiality of sensitive configuration data. This allows attackers with access to configuration exports or URI scheme data to reverse the encryption and extract plaintext credentials and connection information.

Attack Vector

The vulnerability can be exploited through multiple attack vectors:

1. Configuration File Interception: Attackers who gain access to exported configuration files can extract sensitive data by exploiting the weak encryption.

2. URI Scheme Handler Abuse: Custom RustDesk URI schemes (used for easy client configuration) can be intercepted and decoded to reveal embedded credentials.

3. CLI Configuration Parameter: Configuration data passed via the --config command-line parameter may be vulnerable to extraction through process monitoring or log analysis.

The network-based attack vector with no authentication requirements means that any configuration data transmitted or stored using the affected cryptographic implementation is at risk of exposure.

Detection Methods for CVE-2026-30791

Indicators of Compromise

• Unusual access patterns to RustDesk configuration files in user directories
• Unexpected invocations of RustDesk with --config parameters from non-standard processes
• Evidence of RustDesk URI scheme handling from untrusted sources
• Configuration files being accessed by processes other than the RustDesk client itself

Detection Strategies

• Monitor file system access to RustDesk configuration directories across all supported platforms
• Implement network traffic analysis to detect transmission of RustDesk configuration data
• Deploy endpoint detection rules that alert on suspicious command-line usage of the RustDesk client with configuration parameters
• Audit URI scheme handler registrations and invocations on managed endpoints

Monitoring Recommendations

• Enable verbose logging for RustDesk client operations where available
• Implement Data Loss Prevention (DLP) rules to detect RustDesk configuration file exfiltration
• Monitor for processes attempting to read RustDesk configuration stores
• Track network connections associated with configuration import/export operations

How to Mitigate CVE-2026-30791

Immediate Actions Required

• Audit all deployed RustDesk Client installations to identify versions through 1.4.5
• Avoid transmitting or storing RustDesk configuration exports over untrusted networks
• Review and rotate any credentials that may have been embedded in RustDesk configurations
• Consider implementing additional encryption layers for configuration data in transit
• Monitor for security updates from RustDesk that address this cryptographic weakness

Patch Information

Organizations should monitor the RustDesk Client Documentation for updates regarding patches that address this vulnerability. At the time of publication, users running RustDesk Client through version 1.4.5 are affected and should plan to upgrade once a fix is available.

Additional security information can be found in the Google Document Security Overview and the VulSec Security Resource Hub.

Workarounds

• Disable or restrict usage of the URI scheme handler for RustDesk configuration imports on managed systems
• Implement network-level controls to prevent unauthorized transmission of RustDesk configuration files
• Use enterprise key management solutions to add an additional layer of encryption to configuration data
• Restrict CLI access to the --config parameter through application control policies
• Deploy RustDesk configurations through secure, authenticated channels only

# Example: Disable RustDesk URI scheme handler on Linux systems
# Remove or restrict the desktop file that registers the URI handler
sudo rm /usr/share/applications/rustdesk-uri-handler.desktop
# Update desktop database
sudo update-desktop-database