CVE-2026-30792: RustDesk Client MitM Vulnerability

CVE-2026-30792 Overview

A critical vulnerability has been identified in RustDesk Client that enables Application API Message Manipulation through Man-in-the-Middle attacks. This security flaw affects the strategy synchronization, HTTP API client, and configuration options engine modules across all supported platforms. The vulnerability is associated with program files src/hbbs_http/sync.rs and hbb_common/src/config.rs, specifically within the Strategy merge loop in sync.rs and the Config::set_options() routine.

Critical Impact

Attackers positioned in a Man-in-the-Middle scenario can manipulate API messages to compromise confidentiality and integrity of RustDesk Client communications, potentially leading to unauthorized configuration changes and data interception.

Affected Products

• RustDesk Client through version 1.4.5 on Windows
• RustDesk Client through version 1.4.5 on MacOS
• RustDesk Client through version 1.4.5 on Linux
• RustDesk Client through version 1.4.5 on iOS
• RustDesk Client through version 1.4.5 on Android
• RustDesk Client through version 1.4.5 WebClient

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-30792 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-30792

Vulnerability Analysis

This vulnerability is classified under CWE-657 (Violation of Secure Design Principles), indicating a fundamental weakness in how the RustDesk Client handles API communications and configuration synchronization. The flaw allows network-positioned attackers to intercept and modify API messages exchanged between the client and server components without proper validation or integrity checks.

The affected components handle critical functionality including strategy synchronization between client and server, HTTP API client operations, and configuration option management. When these modules fail to properly validate the authenticity and integrity of received messages, an attacker can inject malicious configurations or manipulate synchronization data.

The vulnerability has significant implications for confidentiality and integrity, allowing attackers to potentially capture sensitive session data, inject malicious configuration options that persist across sessions, and manipulate the client's behavior through modified API responses.

Root Cause

The root cause lies within the Strategy merge loop implementation in sync.rs and the Config::set_options() function in config.rs. These routines process incoming configuration and synchronization data without adequate verification of message authenticity. The absence of proper cryptographic validation or message integrity checks allows intercepted communications to be modified and forwarded to the client, which accepts the manipulated data as legitimate.

Attack Vector

This is a network-based attack that requires the attacker to position themselves between the RustDesk Client and its configured server (Man-in-the-Middle position). The attack can be executed without any privileges or user interaction required. An attacker could achieve this position through:

• ARP spoofing on local networks
• DNS poisoning or hijacking
• Compromised network infrastructure
• Rogue access points or network proxies

Once positioned, the attacker intercepts HTTP API communications and can modify the strategy synchronization messages or configuration options being transmitted. The manipulated messages are then processed by the vulnerable routines in sync.rs and config.rs, allowing the attacker to alter client behavior or extract sensitive information.

Detection Methods for CVE-2026-30792

Indicators of Compromise

• Unexpected changes to RustDesk Client configuration settings that were not initiated by users
• Network traffic anomalies indicating potential interception between RustDesk Client and server endpoints
• Unusual API response patterns or configuration synchronization behaviors in client logs
• Certificate warnings or TLS/SSL connection issues when connecting to RustDesk servers

Detection Strategies

• Implement network traffic analysis to identify Man-in-the-Middle indicators such as ARP spoofing or DNS manipulation
• Monitor RustDesk Client logs for unexpected configuration changes or synchronization anomalies
• Deploy endpoint detection rules to identify modifications to RustDesk configuration files outside of normal update processes
• Use network segmentation and monitoring to detect unauthorized interception points

Monitoring Recommendations

• Enable verbose logging on RustDesk Client to capture detailed API communication and configuration change events
• Implement certificate pinning validation monitoring to detect potential MitM attempts
• Configure alerts for any modifications to the config.rs configuration storage locations on endpoints
• Monitor for network-level indicators of interception attacks targeting RustDesk communication ports

How to Mitigate CVE-2026-30792

Immediate Actions Required

• Upgrade RustDesk Client to a version newer than 1.4.5 when a patched release becomes available
• Ensure all RustDesk Client communications traverse trusted, encrypted network paths
• Implement network-level protections against Man-in-the-Middle attacks such as ARP spoofing detection
• Review and audit current RustDesk Client configurations for any unauthorized modifications

Patch Information

Organizations should monitor the official RustDesk release channels for security updates addressing this vulnerability. The RustDesk Client Configuration Guide provides information on client configuration options. Additional technical details about this vulnerability can be found in the Google Document Overview and VulSec Security Resources.

Workarounds

• Deploy network-level encryption (VPN) for all RustDesk communications until a patch is available
• Implement strict network access controls to limit potential Man-in-the-Middle attack surfaces
• Use host-based firewalls to restrict RustDesk Client communications to known, trusted server addresses only
• Consider temporarily restricting RustDesk Client usage to isolated, trusted network segments

# Network restriction example for RustDesk communications
# Restrict RustDesk to communicate only with trusted server IPs
iptables -A OUTPUT -p tcp --dport 21115:21119 -d <TRUSTED_SERVER_IP> -j ACCEPT
iptables -A OUTPUT -p tcp --dport 21115:21119 -j DROP