CVE-2026-30797: RustDesk Client Auth Bypass Vulnerability

CVE-2026-30797 Overview

CVE-2026-30797 is a Missing Authorization vulnerability affecting RustDesk Client across multiple platforms including Windows, MacOS, Linux, iOS, and Android. The vulnerability exists in the Flutter URI scheme handler and config import modules, specifically within flutter/lib/common.Dart and the importConfig() routine via URI handler. This flaw allows attackers to perform Application API Message Manipulation through Man-in-the-Middle attacks.

Critical Impact

Attackers can intercept and manipulate configuration imports in RustDesk Client through the URI scheme handler, potentially leading to unauthorized access to remote desktop sessions, credential theft, and complete compromise of both client and connected systems.

Affected Products

• RustDesk Client through version 1.4.5 on Windows
• RustDesk Client through version 1.4.5 on MacOS
• RustDesk Client through version 1.4.5 on Linux
• RustDesk Client through version 1.4.5 on iOS
• RustDesk Client through version 1.4.5 on Android

Discovery Timeline

• 2026-03-05 - CVE-2026-30797 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-30797

Vulnerability Analysis

This vulnerability stems from CWE-749: Exposed Dangerous Method or Function. The RustDesk Client application exposes the importConfig() function through a URI scheme handler without proper authorization checks. When a user clicks on a malicious URI or is subjected to a Man-in-the-Middle attack, an attacker can manipulate the configuration data being imported into the RustDesk Client.

The Flutter-based implementation in flutter/lib/common.Dart processes configuration imports without validating the source or integrity of the configuration data. This allows unauthorized parties to inject malicious configurations that could redirect remote desktop connections, modify authentication parameters, or alter security settings within the client application.

The cross-platform nature of this vulnerability significantly amplifies its impact, as it affects all major desktop and mobile operating systems where RustDesk Client is deployed. Remote desktop applications are particularly sensitive to authorization bypasses since they inherently provide access to system resources.

Root Cause

The root cause lies in the missing authorization checks within the importConfig() function when invoked via the URI scheme handler. The application fails to verify that configuration import requests originate from trusted sources before processing them. This architectural weakness allows external entities to trigger configuration changes without proper authentication or user consent verification, exposing a dangerous function to potential abuse.

Attack Vector

An attacker can exploit this vulnerability through network-based Man-in-the-Middle attacks. The attack requires user interaction, such as clicking a malicious link that invokes the RustDesk URI scheme handler. Once triggered, the attacker can intercept and modify the configuration data in transit, injecting malicious parameters that alter the client's behavior.

The exploitation scenario involves intercepting network traffic between the victim and legitimate RustDesk resources, then manipulating the configuration payload to include attacker-controlled server addresses, modified encryption settings, or altered authentication tokens. Given that no authorization validation occurs, the client accepts and applies these malicious configurations.

Detection Methods for CVE-2026-30797

Indicators of Compromise

• Unexpected configuration changes in RustDesk Client settings files
• Unusual outbound connections to unknown remote desktop servers
• Modified URI scheme handler registrations on the system
• Unexpected importConfig() invocations in application logs
• Configuration files with timestamps inconsistent with user activity

Detection Strategies

• Monitor for suspicious URI scheme invocations targeting rustdesk:// handlers
• Implement network traffic analysis to detect Man-in-the-Middle attack patterns
• Review RustDesk Client configuration files for unauthorized modifications
• Deploy endpoint detection rules for unexpected configuration import activities

Monitoring Recommendations

• Enable verbose logging in RustDesk Client to capture configuration change events
• Implement file integrity monitoring on RustDesk configuration directories
• Monitor network connections from RustDesk processes for anomalous destinations
• Configure alerts for URI scheme handler invocations from untrusted sources

How to Mitigate CVE-2026-30797

Immediate Actions Required

• Update RustDesk Client to the latest version beyond 1.4.5 when available
• Disable or restrict URI scheme handler functionality if not required
• Implement network segmentation to reduce Man-in-the-Middle attack opportunities
• Review and verify current RustDesk Client configurations for unauthorized changes
• Enable TLS certificate pinning where possible to prevent interception attacks

Patch Information

Organizations should monitor the RustDesk Client Documentation for official security updates. Additional technical details may be available in the security advisory document. Users are advised to update to versions newer than 1.4.5 once patches are released by the RustDesk development team.

Workarounds

• Disable the RustDesk URI scheme handler through operating system settings until a patch is available
• Configure firewall rules to restrict RustDesk network communications to known trusted endpoints
• Use VPN connections when operating RustDesk Client on untrusted networks
• Implement application whitelisting to prevent unauthorized configuration imports
• Manually review all configuration changes before accepting them

# Configuration example - Disable URI scheme handler on Linux
# Remove or comment out the handler registration
# Location varies by installation method
sudo rm /usr/share/applications/rustdesk-uri-handler.desktop
update-desktop-database

# On Windows, remove registry entries for URI handler
# reg delete "HKEY_CLASSES_ROOT\rustdesk" /f