← Vulnerability feed

Vulnerability record · CVE-2026-30793 · published 5 March 2026

CVE-2026-30793: Rustdesk improper authorization vulnerability

Rustdesk · Rustdesk

Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart, src/flutter_ffi.Rs and program routines URI handler for rustdesk://password/, bind.MainSetPermanentPassword(). This issue affects RustDesk Client: through 1.4.5.

9.3 CVSS 4.0 Critical EPSS 0.34% · top 75.2% CWE-285 · Improper authorizationCWE-352 · Cross-site request forgery
9.3CVSS 4.0 base score
0.34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart, src/flutter_ffi.Rs and program routines URI handler for rustdesk://password/, bind.MainSetPermanentPassword(). This issue affects RustDesk Client: through 1.4.5.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9a ExploitThird Party Advisory
https://github.com/rustdesk/hbb_common Product
https://github.com/rustdesk/rustdesk Product
https://www.vulsec.org/ Not Applicable

Track CVE-2026-30793 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-25140Rustdesk improper certificate validation vulnerabilityA default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key U…EPSS 0.51%9.3CVE-2026-30797Rustdesk missing authorization vulnerabilityMissing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme han…EPSS 0.56%8.7CVE-2026-30795Rustdesk cleartext transmission vulnerabilityCleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Andro…EPSS 0.32%8.7CVE-2026-30791Rustdesk broken cryptographic algorithm vulnerabilityUse of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Andr…EPSS 0.33%8.3CVE-2026-30792Rustdesk insufficient verification of data authenticity vulnerabilityA vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Strategy sync, HTTP API client,…EPSS 0.29%8.2CVE-2026-30798Rustdesk insufficient verification of data authenticity vulnerabilityInsufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk…EPSS 0.33%8.2CVE-2026-30785Rustdesk prototype pollution vulnerabilityImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effor…EPSS 0.14%5.7CVE-2026-30789Rustdesk vulnerabilityUse of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-clie…EPSS 0.33%

Source: NIST National Vulnerability Database (record CVE-2026-30793), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.