PT-2026-23465 · Unknown · Rustdesk Server

Erez Kalman · Published 2026-03-05 · Updated 2026-03-05 · CVE-2026-30784

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RustDesk Server versions through 1.7.5 RustDesk Server versions through 1.1.15

Description A missing authorization and authentication issue exists in the RustDesk Server’s Rendezvous server (hbbs) and relay server (hbbr) modules, potentially allowing privilege abuse. The issue is present in the src/rendezvous server.rs and src/relay server.rs program files, specifically within the handle punch hole request() function and the RegisterPeer handler, as well as relay forwarding routines.

Recommendations Update RustDesk Server to a version later than 1.7.5. Update RustDesk Server to a version later than 1.1.15.

Exploit

Fix

Missing Authorization

Missing Authentication

Weakness Enumeration

CWE-862

CWE-306

Related Identifiers

CVE-2026-30784

Affected Products

Rustdesk Server

References · 6

• 🔥 https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30784 · Security Note
• https://rustdesk.com/docs/en/self-host · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2029620488234815726 · Twitter Post
• https://twitter.com/CVEnew/status/2029654728167018976 · Twitter Post
• https://vulsec.org · Note