PT-2026-23460 · Unknown · Rustdesk Client

Erez Kalman · Published 2026-03-05 · Updated 2026-03-05 · CVE-2026-30795

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RustDesk Client versions through 1.4.5

Description A cleartext transmission of sensitive information issue exists in RustDesk Client on Windows, MacOS, Linux, iOS, and Android, specifically within the Heartbeat sync loop modules. This allows for potential sniffing attacks. The issue is related to the construction of Heartbeat JSON payloads, including preset address book passwords, within the src/hbbs http/sync.Rs file and the Heartbeat routine.

Recommendations Update RustDesk Client to a version later than 1.4.5.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2026-30795

Affected Products

Rustdesk Client

References · 7

• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://osv.dev/vulnerability/CVE-2026-30795 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30795 · Security Note
• https://github.com/rustdesk/rustdesk · Note
• https://vulsec.org · Note
• https://twitter.com/CVEnew/status/2029654737910370624 · Twitter Post
• https://t.me/CVEtracker/46454 · Telegram Post