CVE-2026-30792: RustDesk Client MitM Vulnerability

CVE-2026-30792 Overview

A critical vulnerability has been identified in RustDesk Client that enables Application API Message Manipulation through Man-in-the-Middle attacks. This security flaw affects the strategy synchronization, HTTP API client, and configuration options engine modules across all supported platforms. The vulnerability is associated with program files src/hbbs_http/sync.rs and hbb_common/src/config.rs, specifically within the Strategy merge loop in sync.rs and the Config::set_options() routine.

Critical Impact
Attackers positioned in a Man-in-the-Middle scenario can manipulate API messages to compromise confidentiality and integrity of RustDesk Client communications, potentially leading to unauthorized configuration changes and data interception.

Affected Products

RustDesk Client through version 1.4.5 on Windows
RustDesk Client through version 1.4.5 on MacOS
RustDesk Client through version 1.4.5 on Linux
RustDesk Client through version 1.4.5 on iOS
RustDesk Client through version 1.4.5 on Android
RustDesk Client through version 1.4.5 WebClient

Discovery Timeline

2026-03-05 - CVE CVE-2026-30792 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-30792

Vulnerability Analysis

This vulnerability is classified under CWE-657 (Violation of Secure Design Principles), indicating a fundamental weakness in how the RustDesk Client handles API communications and configuration synchronization. The flaw allows network-positioned attackers to intercept and modify API messages exchanged between the client and server components without proper validation or integrity checks.

The affected components handle critical functionality including strategy synchronization between client and server, HTTP API client operations, and configuration option management. When these modules fail to properly validate the authenticity and integrity of received messages, an attacker can inject malicious configurations or manipulate synchronization data.

The vulnerability has significant implications for confidentiality and integrity, allowing attackers to potentially capture sensitive session data, inject malicious configuration options that persist across sessions, and manipulate the client's behavior through modified API responses.

Root Cause

The root cause lies within the Strategy merge loop implementation in sync.rs and the Config::set_options() function in config.rs. These routines process incoming configuration and synchronization data without adequate verification of message authenticity. The absence of proper cryptographic validation or message integrity checks allows intercepted communications to be modified and forwarded to the client, which accepts the manipulated data as legitimate.

Attack Vector

This is a network-based attack that requires the attacker to position themselves between the RustDesk Client and its configured server (Man-in-the-Middle position). The attack can be executed without any privileges or user interaction required. An attacker could achieve this position through:

ARP spoofing on local networks
DNS poisoning or hijacking
Compromised network infrastructure
Rogue access points or network proxies

Once positioned, the attacker intercepts HTTP API communications and can modify the strategy synchronization messages or configuration options being transmitted. The manipulated messages are then processed by the vulnerable routines in sync.rs and config.rs, allowing the attacker to alter client behavior or extract sensitive information.

Detection Methods for CVE-2026-30792

Indicators of Compromise

Unexpected changes to RustDesk Client configuration settings that were not initiated by users
Network traffic anomalies indicating potential interception between RustDesk Client and server endpoints
Unusual API response patterns or configuration synchronization behaviors in client logs
Certificate warnings or TLS/SSL connection issues when connecting to RustDesk servers

Detection Strategies

Implement network traffic analysis to identify Man-in-the-Middle indicators such as ARP spoofing or DNS manipulation
Monitor RustDesk Client logs for unexpected configuration changes or synchronization anomalies
Deploy endpoint detection rules to identify modifications to RustDesk configuration files outside of normal update processes
Use network segmentation and monitoring to detect unauthorized interception points

Monitoring Recommendations

Enable verbose logging on RustDesk Client to capture detailed API communication and configuration change events
Implement certificate pinning validation monitoring to detect potential MitM attempts
Configure alerts for any modifications to the config.rs configuration storage locations on endpoints
Monitor for network-level indicators of interception attacks targeting RustDesk communication ports

How to Mitigate CVE-2026-30792

Immediate Actions Required

Upgrade RustDesk Client to a version newer than 1.4.5 when a patched release becomes available
Ensure all RustDesk Client communications traverse trusted, encrypted network paths
Implement network-level protections against Man-in-the-Middle attacks such as ARP spoofing detection
Review and audit current RustDesk Client configurations for any unauthorized modifications

Patch Information

Organizations should monitor the official RustDesk release channels for security updates addressing this vulnerability. The RustDesk Client Configuration Guide provides information on client configuration options. Additional technical details about this vulnerability can be found in the Google Document Overview and VulSec Security Resources.

Workarounds

Deploy network-level encryption (VPN) for all RustDesk communications until a patch is available
Implement strict network access controls to limit potential Man-in-the-Middle attack surfaces
Use host-based firewalls to restrict RustDesk Client communications to known, trusted server addresses only
Consider temporarily restricting RustDesk Client usage to isolated, trusted network segments

bash

# Network restriction example for RustDesk communications
# Restrict RustDesk to communicate only with trusted server IPs
iptables -A OUTPUT -p tcp --dport 21115:21119 -d <TRUSTED_SERVER_IP> -j ACCEPT
iptables -A OUTPUT -p tcp --dport 21115:21119 -j DROP