CVE-2026-58056 Overview
CVE-2026-58056 is an authorization bypass vulnerability in RustDesk, an open-source remote desktop application. The flaw stems from RustDesk gating incoming control messages on per-capability flags rather than on the session's authorized connection type. A file-transfer session does not clear those flags, allowing a peer holding only a valid FileTransfer authorization to inject keyboard and mouse input. The same peer can also reach unguarded screenshot and display-capture handlers, acting outside its granted scope. The vulnerability is tracked under CWE-863: Incorrect Authorization.
Critical Impact
An authenticated peer authorized only for file transfer can escalate to full input injection and screen capture, breaking the boundary between the FileTransfer and RemoteControl connection types.
Affected Products
- RustDesk remote desktop software
- Deployments exposing FileTransfer sessions to lower-privileged peers
- Self-hosted RustDesk servers relying on connection-type separation for least privilege
Discovery Timeline
- 2026-06-28 - CVE-2026-58056 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-58056
Vulnerability Analysis
RustDesk supports multiple session types, including RemoteControl and FileTransfer, each intended to grant a distinct scope of capabilities. The server should reject control-plane messages such as keyboard events, mouse events, and display capture requests when a session is negotiated as FileTransfer only. Instead, RustDesk evaluates authorization by consulting per-capability flags stored on the session. When a FileTransfer session is established, those flags are not reset or reduced to reflect the narrower scope. A peer that authenticated for file transfer therefore retains flags that permit input injection and screen capture handlers to execute.
Exploitation requires a valid credential for a FileTransfer connection, which corresponds to low authenticated privileges over the network. Once connected, the attacker sends control messages that would normally be reserved for a RemoteControl session. The vulnerability produces a high integrity impact by allowing input to be injected into the victim's active desktop.
Root Cause
The root cause is a design mismatch between how sessions are authorized and how individual message handlers verify permission. Authorization decisions bind to capability flags rather than to the connection type negotiated at session establishment. Because the FileTransfer code path never clears the input and capture flags, the message dispatcher accepts messages that fall outside the file-transfer scope. This is a classic incorrect authorization pattern [CWE-863], where the enforcement point trusts state that was never constrained to match the granted role.
Attack Vector
The attack originates from an authenticated peer over the network with only FileTransfer rights. The attacker establishes a FileTransfer session against the target RustDesk instance using valid credentials or a shared session code. After the session is authorized, the attacker crafts protocol messages carrying keyboard input, mouse input, screenshot requests, and display capture commands. The RustDesk peer processes these messages because the corresponding capability flags remain set. No user interaction is required on the victim side beyond the initial acceptance of the file-transfer session.
Technical details and proof-of-concept material are documented in the VulnCheck Security Advisory and the GitHub PoC Repository.
Detection Methods for CVE-2026-58056
Indicators of Compromise
- FileTransfer sessions that emit keyboard, mouse, or display capture protocol messages after negotiation.
- Unexpected screenshot or display-capture handler invocations correlated to peers connected under a FileTransfer role.
- Session logs showing input events sourced from peers whose authorization token grants only file transfer scope.
Detection Strategies
- Inspect RustDesk server and client logs for message-type distributions per session; alert when FileTransfer sessions contain RemoteControl-class messages.
- Correlate peer identity and authorized connection type with the handlers invoked during the session to surface scope violations.
- Baseline normal file-transfer traffic patterns and flag sessions with anomalous input or capture message ratios.
Monitoring Recommendations
- Enable verbose session logging on RustDesk peers and forward logs to a central analytics pipeline for review.
- Monitor endpoints running RustDesk for unexpected input injection or screen-capture activity that lacks a corresponding interactive user action.
- Track outbound and inbound connections to RustDesk relay servers and correlate with authorized user activity windows.
How to Mitigate CVE-2026-58056
Immediate Actions Required
- Inventory all RustDesk deployments and identify hosts that accept FileTransfer sessions from external or lower-privileged peers.
- Restrict RustDesk permanent passwords and one-time access codes for FileTransfer usage to trusted peers only.
- Disable unattended access on hosts that do not require it until a patched RustDesk release is deployed.
Patch Information
No fixed version is listed in the NVD entry at the time of publication. Administrators should track the VulnCheck Security Advisory and the RustDesk project release notes for a patched build that clears input and capture capability flags on FileTransfer sessions. Update all RustDesk clients and servers as soon as a corrected release becomes available.
Workarounds
- Limit RustDesk to network segments where only trusted peers can reach the service, using host firewall or network ACLs.
- Require interactive user approval for every incoming session and avoid granting persistent file-transfer credentials to untrusted parties.
- Prefer alternative file transfer channels for untrusted counterparties until the authorization scope enforcement is fixed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
