CVE-2026-57850: RustDesk Auth Bypass Vulnerability

CVE-2026-57850 Overview

RustDesk versions before 1.4.9 fail to enforce session authorization scope on the server side. An authenticated peer granted a limited session type such as FileTransfer, PortForward, ViewCamera, or Terminal can transmit control messages reserved for a full Remote session. The server accepts these out-of-scope messages without validation, allowing the peer to observe and control the host beyond its granted permissions. The vulnerability is tracked as a missing authorization weakness [CWE-862] and affects the popular open-source remote desktop software.

Critical Impact
An authenticated remote peer with restricted session access can inject control messages to escalate their capabilities, gaining full remote control over a host that only intended to grant file transfer, port forwarding, camera viewing, or terminal access.

Affected Products

RustDesk versions prior to 1.4.9
RustDesk clients configured with restricted session permissions
Self-hosted RustDesk server deployments running vulnerable client builds

Discovery Timeline

2026-07-10 - CVE-2026-57850 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-57850

Vulnerability Analysis

RustDesk supports multiple session types, each intended to grant a distinct level of access to the host. The connection handshake declares the session type, and the client-side UI exposes only the controls appropriate to that scope. However, the server code path processing incoming control messages does not verify that the received message matches the negotiated session type. A peer that establishes a FileTransfer, PortForward, ViewCamera, or Terminal session can craft protocol messages normally reserved for a full Remote session and the server will execute them.

This allows an authenticated attacker to send input events, capture the screen, adjust login options, or issue other control primitives outside the scope the operator authorized. The trust boundary between session types collapses because enforcement was implemented only in the UI layer.

Root Cause

The root cause is missing authorization [CWE-862]. Session scope was treated as a client-side presentation constraint rather than a server-enforced security boundary. Message handlers dispatched incoming control messages based on message type alone, without cross-referencing the session type negotiated at connection establishment.

Attack Vector

Exploitation requires an authenticated peer connection. The attacker requests a limited session type, completes authentication, and then transmits control protocol messages associated with a full Remote session. Because the server-side handler does not check the scope, these messages are executed against the host.

text

// Patch excerpt from flutter/lib/common/widgets/toolbar.dart
// Fix/session scope permission audit (#15469)
   // to-do:
   // 1. Web desktop
   // 2. Mobile, copy the image to the clipboard
-  if (isDesktop) {
+  if ((isDefaultConn || ffi.connType == ConnType.viewCamera) && isDesktop) {
     final isScreenshotSupported = bind.sessionGetCommonSync(
         sessionId: sessionId, key: 'is_screenshot_supported', param: '');
     if ('true' == isScreenshotSupported) {

Source: GitHub Commit 493b14b. The patch introduces explicit connection type checks (isDefaultConn || ffi.connType == ConnType.viewCamera) before enabling features such as screenshot capture, gating capabilities behind the negotiated session scope.

Detection Methods for CVE-2026-57850

Indicators of Compromise

RustDesk client processes running versions earlier than 1.4.9 accepting inbound connections
Unexpected input events (mouse, keyboard) or screen capture activity on hosts where only FileTransfer or PortForward sessions were authorized
Session logs showing a connection negotiated as Terminal or ViewCamera that subsequently issued Remote-session control messages

Detection Strategies

Inventory endpoints running RustDesk and correlate installed versions against 1.4.9 to surface vulnerable builds
Monitor for RustDesk network traffic to and from untrusted peers, particularly authenticated sessions originating from external IP ranges
Review RustDesk audit logs for mismatches between the initial session type and the operations subsequently performed within that session

Monitoring Recommendations

Alert on new RustDesk process installations and connections from previously unseen peer IDs
Log outbound and inbound connections to RustDesk relay servers and rendezvous services for anomaly baselining
Track modifications to RustDesk configuration files that adjust permission or session-type defaults

How to Mitigate CVE-2026-57850

Immediate Actions Required

Upgrade all RustDesk client and server components to version 1.4.9 or later
Audit every host permitting inbound RustDesk connections and rotate any shared or permanent access credentials
Restrict RustDesk peer connectivity to trusted networks using host firewall rules until patching is complete

Patch Information

The fix is delivered in RustDesk Release 1.4.9 via Pull Request #15469 and Commit 493b14b. The patch enforces session scope checks on control paths so that limited session types cannot invoke Remote-session functionality. Details are documented in the VulnCheck RustDesk Advisory.

Workarounds

Disable inbound RustDesk connections on hosts that cannot be upgraded immediately
Only permit peers you fully trust with Remote session access, since limited scopes cannot be relied upon on unpatched builds
Block RustDesk relay traffic at the network perimeter for environments where remote access is not required

bash

# Verify installed RustDesk version and block the service until patched
rustdesk --version

# Linux systemd example: stop and disable the service pending upgrade
sudo systemctl stop rustdesk
sudo systemctl disable rustdesk

# Windows example: stop the service
sc stop rustdesk
sc config rustdesk start= disabled