PT-2026-23459 · Rustdesk · Rustdesk Client

Erez Kalman · Published 2026-03-05 · Updated 2026-03-05 · CVE-2026-30794

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions RustDesk Client versions through 1.4.5

Description An improper certificate validation issue exists in the RustDesk Client, potentially allowing an Adversary in the Middle (AiTM) attack. The issue is related to the handling of TLS retries and the use of danger accept invalid certs(true) within the http client.Rs file. This affects the HTTP API client and TLS transport modules on Windows, MacOS, Linux, iOS, and Android.

Recommendations Update RustDesk Client to a version later than 1.4.5.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-30794

Affected Products

Rustdesk Client

References · 8

• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://osv.dev/vulnerability/CVE-2026-30794 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30794 · Security Note
• https://github.com/rustdesk/rustdesk · Note
• https://vulsec.org · Note
• https://twitter.com/VulmonFeeds/status/2029612809647013936 · Twitter Post
• https://t.me/CVEtracker/46453 · Telegram Post
• https://twitter.com/CVEnew/status/2029654738904531337 · Twitter Post