CVE-2026-67289 Overview
CVE-2026-67289 is a critical HTTP request injection vulnerability in FreeRDP versions 3.28.0 and earlier. The flaw resides in how FreeRDP handles the server-controlled TargetNetAddress field within RDP redirection Protocol Data Units (PDUs). FreeRDP fails to validate Carriage Return Line Feed (CRLF) sequences and other control characters before copying the value into the client's ServerHostname. When the client connects through an HTTP proxy, the unfiltered value is written directly into the proxy CONNECT request line and Host header by http_proxy_connect(). A malicious or compromised RDP server can leverage this to inject arbitrary HTTP headers or full requests into the proxy connection.
Critical Impact
A hostile RDP server can smuggle arbitrary HTTP requests through the victim's HTTP proxy, enabling proxy abuse, SSRF-like pivoting, and interaction with internal services reachable by the proxy.
Affected Products
- FreeRDP versions <= 3.28.0
- FreeRDP client builds compiled with HTTP proxy support
- Downstream applications embedding vulnerable FreeRDP libraries
Discovery Timeline
- 2026-08-01 - CVE-2026-67289 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-67289
Vulnerability Analysis
The vulnerability is classified under [CWE-113]: Improper Neutralization of CRLF Sequences in HTTP Headers. FreeRDP acts as an RDP client that can be configured to tunnel its connection through an HTTP proxy using the CONNECT method. During the RDP session, a server may issue a redirection PDU instructing the client to reconnect to a different target host. The TargetNetAddress field in that PDU is attacker-controlled when the initial server is malicious.
FreeRDP copies this value into the internal ServerHostname field without validating or stripping control characters. When the client reconnects through the proxy, http_proxy_connect() assembles the CONNECT host:port HTTP/1.1 request line and Host: header directly from the hostname string. Embedded \r\n sequences terminate the current header and allow an attacker to append arbitrary headers or entire follow-on HTTP requests.
Root Cause
The root cause is missing input neutralization at the boundary between the RDP protocol layer and the HTTP proxy client. The http_proxy_connect() function trusts that hostnames provided by upstream code contain only valid host characters. No sanitization routine strips or rejects \r, \n, or other HTTP-significant control bytes before format-string style concatenation into the request buffer.
Attack Vector
An attacker operates or compromises an RDP server that a FreeRDP client connects to through an HTTP proxy. The server sends a legitimate Server_Redirection_Packet containing a crafted TargetNetAddress such as attacker.example\r\nX-Injected: value\r\n\r\nGET /internal HTTP/1.1\r\nHost: internal-service. When FreeRDP processes the redirection, it writes the poisoned string into the outbound proxy request, allowing header injection or HTTP request smuggling against the proxy or backend services.
The upstream fix is available in the FreeRDP security patch commit. Additional analysis is provided in the FreeRDP GHSA-mwwh-mhp9-q7vm advisory and the VulnCheck advisory.
Detection Methods for CVE-2026-67289
Indicators of Compromise
- Outbound HTTP CONNECT requests from FreeRDP clients containing embedded CRLF sequences or unexpected header names in the request line.
- Proxy access logs showing malformed Host: headers or multiple HTTP methods within a single client connection.
- RDP sessions terminated immediately after receipt of a Server_Redirection_Packet from an untrusted server.
Detection Strategies
- Inspect HTTP proxy logs for CONNECT targets containing non-hostname characters, particularly %0d, %0a, or raw control bytes.
- Monitor FreeRDP client processes (xfreerdp, wlfreerdp) for network flows to unexpected proxy destinations following redirection events.
- Correlate RDP redirection PDUs with subsequent proxy CONNECT attempts to detect anomalous target changes.
Monitoring Recommendations
- Enable verbose proxy logging capturing full request lines and headers for connections originating from RDP client hosts.
- Alert on any proxy request line exceeding expected length or containing embedded newlines.
- Track FreeRDP version inventory across the fleet and flag hosts still running versions at or below 3.28.0.
How to Mitigate CVE-2026-67289
Immediate Actions Required
- Upgrade FreeRDP to version 3.29.0 or later on all client systems and rebuild any downstream applications that link the FreeRDP libraries.
- Restrict outbound RDP connections through HTTP proxies to a vetted list of trusted destination servers.
- Audit proxy configurations to ensure CONNECT targets are validated against an allowlist rather than passed through unchecked.
Patch Information
The vulnerability is resolved in FreeRDP 3.29.0. The fix adds validation of control characters in the TargetNetAddress field and sanitizes hostnames before they are used to construct HTTP proxy requests. Refer to the FreeRDP upstream commit for the authoritative patch.
Workarounds
- Disable HTTP proxy usage in FreeRDP client configurations where feasible by unsetting the /proxy command-line option and the http_proxy/https_proxy environment variables.
- Restrict RDP client connections to known-trusted servers only, preventing exposure to attacker-controlled redirection PDUs.
- Deploy egress filtering rules that block FreeRDP clients from reaching arbitrary proxy endpoints.
# Verify installed FreeRDP version and upgrade
xfreerdp --version
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11
# Confirm patched version (>= 3.29.0)
xfreerdp --version | grep -E '3\.(29|[3-9][0-9])'
# Temporary mitigation: unset proxy variables before launching client
unset http_proxy https_proxy
xfreerdp /v:trusted-rdp.example.com
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
