CVE-2026-55626: xrdp Authentication Bypass Vulnerability

CVE-2026-55626 Overview

CVE-2026-55626 is an authentication weakness [CWE-287] in xrdp, an open source Remote Desktop Protocol (RDP) server for Unix-like systems. The flaw affects versions 0.10.6 and prior when authenticated user sessions initialize using the Xvnc backend over UNIX domain sockets. The Xvnc process launches with insufficient authentication mechanisms, allowing a local authenticated attacker to bypass session isolation. Exploitation permits viewing or controlling active desktop sessions belonging to other users on the same system. Deployments using the xorgxrdp backend or Xvnc over TCP sockets are not affected. The maintainers addressed the issue in version 0.10.6.1.

Critical Impact
A local authenticated attacker can hijack other users' active desktop sessions, breaking multi-user session isolation on shared xrdp hosts.

Affected Products

xrdp versions 0.10.6 and prior configured with the Xvnc backend over UNIX domain sockets
Multi-user Linux systems exposing xrdp for remote desktop access
Shared jump hosts and remote workstation servers relying on xrdp session isolation

Discovery Timeline

2026-07-20 - CVE-2026-55626 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-55626

Vulnerability Analysis

xrdp brokers RDP client connections to a local display server such as Xvnc or xorgxrdp. When configured to use Xvnc over UNIX domain sockets, xrdp starts the Xvnc process without enforcing sufficient authentication controls on the socket. Because UNIX domain sockets are addressable by any local user with appropriate filesystem permissions, the missing authentication step allows a second authenticated user on the host to connect to another user's Xvnc instance. Once connected, the attacker interacts with the victim's desktop as if seated at the console, capturing keystrokes, reading on-screen content, and issuing input events.

Root Cause

The root cause is improper authentication [CWE-287] on the Xvnc UNIX domain socket transport. The Xvnc backend is spawned without a strong shared secret or per-session credential that xrdp validates before granting display access. Backends that use TCP sockets or the xorgxrdp module apply different startup paths and are not exposed to this weakness.

Attack Vector

Exploitation requires local access with valid credentials on the target host. The attacker enumerates Xvnc UNIX domain sockets belonging to other users, connects to a socket associated with an active session, and issues VNC protocol messages to observe or control the desktop. No user interaction from the victim is required beyond having an active xrdp session. Refer to the GitHub Security Advisory GHSA-m3xx-cpc4-982r for maintainer-provided technical details.

Detection Methods for CVE-2026-55626

Indicators of Compromise

Unexpected VNC client connections to Xvnc UNIX domain sockets under /tmp/.X11-unix/ or xrdp session directories originating from user IDs other than the session owner.
xrdp session logs in /var/log/xrdp-sesman.log showing Xvnc startup for accounts that did not initiate an RDP connection at the corresponding time.
Anomalous input activity or spawned processes inside a user's desktop session that do not correlate with that user's RDP client connection times.

Detection Strategies

Audit connect() syscalls to Xvnc UNIX domain sockets and alert when the connecting process UID differs from the socket owner UID.
Correlate xrdp session establishment events with authenticated RDP logon events to identify Xvnc processes that receive additional local clients.
Monitor process ancestry for Xvnc children accepting connections from unrelated user contexts on multi-user hosts.

Monitoring Recommendations

Enable Linux auditd rules covering socket operations against /tmp/.xrdp/ and X11 socket paths on hosts running xrdp.
Forward xrdp and xrdp-sesman logs to a centralized logging platform for cross-user session correlation.
Baseline expected concurrent Xvnc sessions per user and alert on deviations that indicate session sharing.

How to Mitigate CVE-2026-55626

Immediate Actions Required

Upgrade xrdp to version 0.10.6.1 or later on all systems using the Xvnc backend with UNIX domain sockets.
Inventory hosts running xrdp and identify which backend and transport each deployment uses.
Terminate active Xvnc sessions after patching to ensure new sessions start under the fixed code path.

Patch Information

The xrdp maintainers released the fix in xrdp v0.10.6.1. Administrators should apply distribution-provided packages once available or build from the tagged release. Details of the coordinated fix are documented in GitHub Security Advisory GHSA-m3xx-cpc4-982r.

Workarounds

Switch the xrdp backend from Xvnc over UNIX domain sockets to xorgxrdp, which is not affected by this vulnerability.
Alternatively, configure Xvnc to use TCP sockets bound to 127.0.0.1 with authentication until the patched version can be deployed.
Restrict interactive local login on xrdp hosts to trusted accounts and enforce least-privilege on shared systems to reduce the pool of potential attackers.

bash

# Verify installed xrdp version and backend configuration
xrdp --version
grep -E '^(use_vsock|ip|port|xserverbpp)' /etc/xrdp/xrdp.ini
grep -E '^(param|Xorg|Xvnc)' /etc/xrdp/sesman.ini