CVE-2026-91949 Overview
CVE-2026-91949 is a protocol negotiation bypass vulnerability affecting FreeRDP server versions before 3.31.0. Unauthenticated attackers can establish RDSTLS connections even when server policy disables them. The flaw exists in how the server handles incompatible protocol requests during the initial negotiation phase. Attackers send an incompatible protocol request, receive a negotiation failure response, then complete the TLS handshake and enter RDSTLS mode. This bypasses pre-authentication transport restrictions intended to enforce administrator security policy. The vulnerability is categorized as a protection mechanism failure [CWE-693].
Critical Impact
Remote unauthenticated attackers can bypass RDSTLS transport restrictions on FreeRDP servers, undermining server-side policy controls before authentication occurs.
Affected Products
- FreeRDP server versions 3.0.0 through 3.30.0
- Applications embedding vulnerable FreeRDP server components
- Downstream distributions packaging FreeRDP prior to 3.31.0
Discovery Timeline
- 2026-09-15 - CVE-2026-91949 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91949
Vulnerability Analysis
The vulnerability resides in FreeRDP's server-side protocol negotiation logic. During RDP connection establishment, the client and server negotiate a security transport such as standard RDP security, TLS, CredSSP, or RDSTLS. Administrators can restrict which transports the server accepts by disabling specific options in server policy. The negotiation flow in vulnerable FreeRDP versions does not consistently enforce these restrictions after an initial failure response. An attacker exploits this by requesting an incompatible protocol, causing the server to return a negotiation failure, then continuing the connection sequence into RDSTLS. The server transitions to RDSTLS despite policy configuration explicitly disabling that path. See the GitHub Security Advisory and the VulnCheck Advisory on FreeRDP for additional context.
Root Cause
The root cause is a state-handling defect in the negotiation state machine. After emitting a negotiation failure packet, the server does not terminate the session or re-validate policy before permitting a subsequent RDSTLS transition. This is a protection mechanism failure classified under [CWE-693].
Attack Vector
Exploitation requires network access to an exposed FreeRDP server. No authentication or user interaction is required. The attacker sends a crafted sequence of negotiation messages, completes the TLS handshake, and enters RDSTLS. The vulnerability affects pre-authentication transport selection, so the attack occurs before any credentials are supplied.
No verified public exploit code is available. Refer to the FreeRDP security advisory for protocol-level details.
Detection Methods for CVE-2026-91949
Indicators of Compromise
- RDP sessions that report a negotiation failure immediately followed by a successful TLS handshake and RDSTLS transition from the same source.
- Inbound RDP connections on port 3389 completing RDSTLS on servers configured to disable it.
- FreeRDP server logs showing protocol downgrade or unexpected security layer transitions during pre-authentication.
Detection Strategies
- Inspect network telemetry for RDP negotiation packets containing incompatible protocol requests followed by continued session activity.
- Correlate FreeRDP server logs with policy configuration to identify RDSTLS sessions that violate configured transport restrictions.
- Deploy signatures that flag RDP flows exhibiting negotiation failure responses without subsequent connection termination.
Monitoring Recommendations
- Enable verbose logging on FreeRDP servers to capture negotiation state transitions and security layer selection.
- Forward RDP session metadata to a centralized SIEM for policy-violation alerting.
- Monitor authentication logs on downstream systems for unexpected RDP-originated sessions after policy hardening.
How to Mitigate CVE-2026-91949
Immediate Actions Required
- Upgrade all FreeRDP server deployments to version 3.31.0 or later.
- Inventory applications and containers that embed FreeRDP libraries and confirm the patched version is in use.
- Restrict network exposure of FreeRDP services to trusted networks or VPN-reachable segments only.
Patch Information
The FreeRDP maintainers addressed the vulnerability in version 3.31.0. Details are available in the GitHub Security Advisory GHSA-x7v6-xfx3-52j6. Downstream package maintainers should rebuild against the fixed release.
Workarounds
- Disable RDSTLS entirely at the network layer where server upgrade is not immediately possible.
- Place FreeRDP servers behind an RDP gateway that enforces transport policy independently.
- Apply strict firewall rules limiting inbound access to authorized clients until patches are deployed.
# Verify installed FreeRDP server version
freerdp-shadow-cli --version
# Example: block external RDP access pending patch deployment
iptables -A INPUT -p tcp --dport 3389 -s 0.0.0.0/0 -j DROP
iptables -A INPUT -p tcp --dport 3389 -s 10.0.0.0/8 -j ACCEPT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
