CVE-2026-42218 Overview
CVE-2026-42218 is a timing side-channel vulnerability in xrdp, an open source Remote Desktop Protocol (RDP) server maintained by neutrinolabs. Versions 0.10.6 and earlier process login requests with measurable differences in response time depending on whether a supplied username exists on the system. A remote unauthenticated attacker can measure these timing discrepancies to enumerate valid usernames. The issue is classified under [CWE-204: Observable Response Discrepancy] and has been fixed in xrdp version 0.10.6.1.
Critical Impact
Unauthenticated remote attackers can enumerate valid system usernames over the network, producing a target list for password spraying, brute force, and credential stuffing follow-on attacks.
Affected Products
- neutrinolabs xrdp versions 0.10.6 and prior
- Linux distributions packaging vulnerable xrdp builds for RDP access
- Remote desktop deployments exposing xrdp login services to untrusted networks
Discovery Timeline
- 2026-07-20 - CVE-2026-42218 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-42218
Vulnerability Analysis
The vulnerability resides in the xrdp login interface, which handles authentication requests received over the RDP protocol. When a user submits credentials, the server executes different code paths depending on whether the supplied username matches a known account. These divergent paths take measurably different amounts of time to complete, producing an observable response discrepancy.
A remote attacker who can reach the RDP service can send authentication attempts for candidate usernames and record the elapsed time until the server responds. By statistically analyzing these timings, the attacker distinguishes valid accounts from invalid ones without needing valid credentials or triggering account lockouts. The information disclosure is limited to username validity, but this data materially accelerates subsequent credential attacks.
Root Cause
The root cause is non-constant-time handling of the authentication flow. Backend lookups, PAM interactions, or error handling for nonexistent users return earlier than the code path executed for existing users, leaking account state through response latency. The fix in version 0.10.6.1 normalizes the response timing so that valid and invalid usernames produce indistinguishable behavior.
Attack Vector
Exploitation requires only network reachability to the xrdp listener, typically TCP port 3389. The attacker iterates through a wordlist of candidate usernames, submitting login attempts and recording the time between request and server response. Statistical comparison across many samples separates the population of valid accounts from invalid ones. No authentication, user interaction, or elevated privileges are required. The technique is described in the vendor advisory at GitHub Security Advisory GHSA-3wr5-fwmh-qh34.
Detection Methods for CVE-2026-42218
Indicators of Compromise
- Large volumes of failed RDP authentication attempts from a single source, targeting many distinct usernames with a single or repeated password
- Sequential or dictionary-ordered username submissions in xrdp session logs (/var/log/xrdp.log, /var/log/xrdp-sesman.log)
- Connections from unexpected geographic regions or hosting providers to internet-exposed RDP endpoints
Detection Strategies
- Alert on authentication failure rates exceeding a baseline threshold per source IP over short time windows
- Correlate xrdp session initiation events with rapid disconnects that indicate scripted probing rather than interactive use
- Monitor for successful logins that immediately follow enumeration bursts, indicating enumeration transitioned into credential attack
Monitoring Recommendations
- Forward xrdp and PAM authentication logs to a centralized SIEM for correlation across hosts
- Track the diversity of usernames attempted per source IP as a behavioral signal for enumeration activity
- Enable network flow logging on TCP port 3389 to identify scanning patterns before authentication logs are generated
How to Mitigate CVE-2026-42218
Immediate Actions Required
- Upgrade xrdp to version 0.10.6.1 or later on all affected systems using the release available at GitHub Release v0.10.6.1
- Restrict network exposure of RDP services by placing xrdp behind a VPN or jump host rather than the public internet
- Enforce rate limiting and account lockout policies to reduce the practicality of automated enumeration and follow-on password attacks
Patch Information
The maintainers fixed the timing discrepancy in xrdp 0.10.6.1. The patch normalizes authentication response paths so valid and invalid usernames produce statistically equivalent response times. Full release details are available at GitHub Release v0.10.6.1, and the coordinated advisory is published at GitHub Security Advisory GHSA-3wr5-fwmh-qh34.
Workarounds
- Limit inbound RDP connections to trusted source networks using host firewall rules (iptables, nftables, or firewalld)
- Deploy fail2ban or equivalent tooling to automatically block source IPs generating repeated authentication failures against xrdp
- Require multi-factor authentication or certificate-based access at a VPN tier so that username enumeration alone provides no path to compromise
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
