PT-2026-23461 · Unknown · Rustdesk Server Pro

Erez Kalman · CVE-2026-30796 · Published 2026-03-05 · Updated 2026-06-22

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RustDesk Server Pro versions through 1.7.5

Description A security issue exists in RustDesk Server Pro related to the transmission of sensitive information in cleartext. The vulnerability is present in the address book sync API modules and allows for potential sniffing attacks. Specifically, the Heartbeat API handler (heartbeatApiHandler()) accepts the preset-address-book-password parameter in plaintext, exposing it during transmission. This affects the heartbeat sync functionality.

Recommendations Versions prior to 1.7.6 should be updated.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Insufficiently Protected Credentials

Weakness Enumeration

CWE-319

CWE-522

Related Identifiers

CVE-2026-30796

Affected Products

Rustdesk Server Pro

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30796.json · Exploit
• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://rustdesk.com/docs/en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30796 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30796 · Vendor Advisory
• https://github.com/rustdesk/rustdesk/releases · Note
• https://github.com/rustdesk/rustdesk,https://github.com/rustdesk/hbb_common · Note
• https://t.me/cveNotify/171426 · Telegram Post
• https://twitter.com/cyberbivash/status/2029617592348869007 · Twitter Post
• https://t.me/cveNotify/171475 · Telegram Post
• https://twitter.com/CVEnew/status/2029654736920629317 · Twitter Post
• https://t.me/CVEtracker/46455 · Telegram Post
• https://vulsec.org · Note