CVE-2026-30796: RustDesk Server Pro Information Disclosure

CVE-2026-30796 Overview

CVE-2026-30796 is a Cleartext Transmission of Sensitive Information vulnerability affecting RustDesk Server Pro, a popular remote desktop server solution. The vulnerability exists in the Address book sync API modules, specifically within the heartbeat sync API endpoint handling routines. The affected API handler accepts preset-address-book-password in plaintext, enabling network-based sniffing attacks that can capture sensitive authentication credentials.

This vulnerability impacts organizations using RustDesk Server Pro for remote access management across Windows, MacOS, and Linux platforms. Attackers positioned on the network path can intercept unencrypted communications to harvest credentials and gain unauthorized access to remote desktop infrastructure.

Critical Impact

Attackers can intercept plaintext credentials transmitted via the Address book sync API, potentially compromising remote desktop access across the entire organization.

Affected Products

• RustDesk Server Pro through version 1.7.5 on Windows
• RustDesk Server Pro through version 1.7.5 on MacOS
• RustDesk Server Pro through version 1.7.5 on Linux

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-30796 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-30796

Vulnerability Analysis

This vulnerability falls under CWE-319 (Cleartext Transmission of Sensitive Information), a fundamental cryptographic weakness where sensitive data is transmitted without encryption. The flaw exists in RustDesk Server Pro's closed-source API endpoint handling, specifically within the heartbeat sync functionality used for address book synchronization.

The heartbeat API handler is designed to manage persistent connections and synchronize address book data between clients and the server. However, the implementation accepts and transmits the preset-address-book-password parameter in plaintext over the network. This architectural oversight means that any network observer—whether through passive sniffing, man-in-the-middle positioning, or compromised network infrastructure—can capture these credentials.

The network-accessible nature of this vulnerability means exploitation does not require prior authentication, user interaction, or any special privileges, making it highly exploitable in enterprise environments where network traffic may traverse untrusted segments.

Root Cause

The root cause of CVE-2026-30796 is the failure to implement transport-layer encryption or application-level encryption for sensitive credential data within the Address book sync API modules. The heartbeat API handler directly processes the preset-address-book-password value without ensuring the communication channel is secured, violating fundamental secure development practices for credential handling.

Attack Vector

The attack vector is network-based, requiring the attacker to have visibility into network traffic between RustDesk clients and the RustDesk Server Pro instance. Common attack scenarios include:

An attacker on the same network segment can use packet capture tools to passively monitor traffic to the RustDesk Server Pro API endpoints. When legitimate users perform address book synchronization operations, the cleartext preset-address-book-password values are captured. These credentials can then be used to authenticate to the RustDesk infrastructure, access address books containing connection details for managed systems, and potentially pivot to compromised endpoints.

The attack is particularly effective in environments where TLS/SSL is not enforced at the application or infrastructure level, or where network segmentation does not adequately protect management traffic.

Detection Methods for CVE-2026-30796

Indicators of Compromise

• Network packet captures containing plaintext preset-address-book-password parameters in HTTP requests to RustDesk Server Pro API endpoints
• Unusual authentication attempts to RustDesk infrastructure from unexpected IP addresses or geographic locations
• Evidence of packet sniffing tools or network monitoring software on compromised systems within the environment
• Unauthorized modifications to address book entries or synchronization patterns

Detection Strategies

• Deploy network traffic analysis tools to identify unencrypted HTTP traffic to RustDesk Server Pro instances on expected API ports
• Configure intrusion detection systems (IDS) to alert on traffic containing preset-address-book-password strings in cleartext
• Monitor authentication logs for anomalous access patterns that may indicate credential theft and replay attacks
• Implement deep packet inspection at network boundaries to detect sensitive credential exposure

Monitoring Recommendations

• Enable comprehensive logging on RustDesk Server Pro instances to track all API authentication events and source IP addresses
• Implement network flow monitoring to detect unusual data exfiltration patterns or connections from unexpected sources
• Configure SIEM rules to correlate RustDesk authentication events with network anomaly detections
• Establish baseline network behavior for address book sync operations to identify deviations indicative of exploitation

How to Mitigate CVE-2026-30796

Immediate Actions Required

• Upgrade RustDesk Server Pro to a patched version beyond 1.7.5 when available from the vendor
• Enforce TLS/SSL encryption for all communications with RustDesk Server Pro API endpoints at the infrastructure level
• Isolate RustDesk Server Pro instances to dedicated network segments with strict access controls
• Review authentication logs for signs of credential compromise and rotate all address book passwords immediately

Patch Information

The vulnerability affects RustDesk Server Pro through version 1.7.5. Organizations should monitor the RustDesk Documentation for official security advisories and patch releases. Additional technical details regarding this vulnerability can be found in the Security Overview Document and VulSec Security Resources.

Workarounds

• Deploy a reverse proxy with TLS termination in front of RustDesk Server Pro to encrypt all client-to-server communications
• Implement VPN requirements for all connections to RustDesk infrastructure to prevent network-level sniffing
• Configure network firewalls to restrict access to RustDesk Server Pro API endpoints to trusted IP ranges only
• Consider disabling address book synchronization features until a patch is available if the functionality is not critical

# Example: Configure nginx as TLS-terminating reverse proxy for RustDesk Server Pro
# /etc/nginx/sites-available/rustdesk-proxy.conf

server {
    listen 443 ssl;
    server_name rustdesk.example.com;
    
    ssl_certificate /etc/ssl/certs/rustdesk.crt;
    ssl_certificate_key /etc/ssl/private/rustdesk.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    
    location / {
        proxy_pass http://127.0.0.1:21115;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}