CVE-2026-30794: RustDesk Client AiTM Vulnerability

CVE-2026-30794 Overview

CVE-2026-30794 is an Improper Certificate Validation vulnerability (CWE-295) affecting the RustDesk Client remote desktop application across all major platforms including Windows, MacOS, Linux, iOS, and Android. The vulnerability exists in the HTTP API client and TLS transport modules, specifically within the src/hbbs_http/http_client.rs file where TLS retry logic improperly uses danger_accept_invalid_certs(true), allowing Adversary-in-the-Middle (AiTM) attacks.

This critical security flaw enables attackers positioned on the network path to intercept, modify, or eavesdrop on communications between RustDesk clients and servers by exploiting the disabled certificate validation during connection retry attempts.

Critical Impact

Attackers can intercept remote desktop sessions, steal authentication credentials, inject malicious commands, and compromise confidentiality and integrity of remote access communications.

Affected Products

• RustDesk Client through version 1.4.5 on Windows
• RustDesk Client through version 1.4.5 on MacOS
• RustDesk Client through version 1.4.5 on Linux
• RustDesk Client through version 1.4.5 on iOS
• RustDesk Client through version 1.4.5 on Android

Discovery Timeline

• 2026-03-05 - CVE-2026-30794 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-30794

Vulnerability Analysis

The vulnerability stems from insecure TLS certificate validation handling in the RustDesk Client's HTTP API communication layer. When the client encounters a TLS connection failure, the retry logic in src/hbbs_http/http_client.rs falls back to using danger_accept_invalid_certs(true), which completely disables certificate chain validation. This implementation flaw means that after an initial failed TLS handshake, subsequent connection attempts will accept any certificate presented by the server, including self-signed, expired, or certificates issued by untrusted Certificate Authorities.

The vulnerable code path affects the TLS transport modules used for communication between RustDesk clients and relay/signaling servers. An attacker who can position themselves in the network path (such as on a compromised network, through ARP spoofing, or DNS hijacking) can present a fraudulent certificate during the retry phase and successfully establish a man-in-the-middle position.

Root Cause

The root cause is improper implementation of TLS certificate validation retry logic in the Rust-based HTTP client code. The danger_accept_invalid_certs(true) function call explicitly disables all certificate validation checks as a fallback mechanism, violating secure coding principles. This likely was implemented as a development convenience or to handle edge cases with self-signed certificates but was inadvertently left in production code paths.

The vulnerability is classified under CWE-295 (Improper Certificate Validation), which encompasses failures to properly verify that a certificate is valid, trusted, and matches the intended host.

Attack Vector

The attack leverages the network-based attack vector requiring the attacker to achieve an adversary-in-the-middle position. The exploitation flow involves:

1. The attacker positions themselves on the network path between the RustDesk client and the legitimate server
2. The attacker causes the initial TLS handshake to fail (through packet manipulation or blocking)
3. The RustDesk client triggers the vulnerable retry logic with certificate validation disabled
4. The attacker presents a malicious certificate for their interception proxy
5. The client accepts the invalid certificate and establishes a connection through the attacker
6. The attacker can now intercept, modify, or inject data into the remote desktop session

This vulnerability enables complete compromise of remote desktop session confidentiality and integrity, including credential theft, session hijacking, and command injection.

Detection Methods for CVE-2026-30794

Indicators of Compromise

• Unexpected TLS certificate errors or warnings in RustDesk client logs followed by successful connections
• Network traffic showing TLS connections to RustDesk servers with certificates not matching expected certificate authorities
• Presence of unknown or self-signed certificates in TLS sessions with RustDesk infrastructure
• DNS resolution anomalies for RustDesk server hostnames

Detection Strategies

• Implement network monitoring to detect TLS certificate mismatches for known RustDesk server endpoints
• Deploy endpoint detection rules to identify RustDesk client processes accepting invalid certificates
• Monitor for ARP spoofing or DNS hijacking indicators that could enable MITM positioning
• Analyze TLS handshake failures followed by successful connections with different certificates

Monitoring Recommendations

• Enable verbose logging on RustDesk clients to capture TLS handshake details and certificate information
• Implement certificate pinning validation at the network perimeter for RustDesk traffic
• Deploy behavioral analytics to detect unusual remote desktop session patterns that may indicate interception
• Correlate authentication events with network anomalies around RustDesk usage

How to Mitigate CVE-2026-30794

Immediate Actions Required

• Upgrade RustDesk Client to a patched version beyond 1.4.5 when available
• Restrict RustDesk usage to trusted network environments until patched
• Implement network-level certificate validation through proxy inspection where possible
• Monitor for indicators of active exploitation in environments using affected versions

Patch Information

Organizations should monitor the GitHub RustDesk Repository for security updates and patched releases. Additional vulnerability details may be available through the Google Document Resource and Vulsec Security Information.

Workarounds

• Use VPN connections to establish trusted network tunnels for all RustDesk communications
• Deploy network segmentation to limit attacker positioning opportunities
• Consider alternative remote desktop solutions until a patch is available for critical use cases
• Implement network-based intrusion detection specifically monitoring for certificate anomalies in RustDesk traffic

# Network monitoring configuration example
# Add firewall rules to log RustDesk traffic for certificate inspection
iptables -A OUTPUT -p tcp --dport 21115:21119 -j LOG --log-prefix "RustDesk Traffic: "
iptables -A OUTPUT -p tcp --dport 21116 -j LOG --log-prefix "RustDesk Relay: "