CVE-2026-30792
Rustdesk ≤ 1.4.5
Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-30792 is a critical-severity Violation of Secure Design Principles (CWE-657) vulnerability in Rustdesk Rustdesk. Its CVSS base score is 9.1 (Critical).
Operationally, ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-5 (Separation of Duties) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-30792 is a vulnerability in the RustDesk Client (rustdesk-client) that enables Application API Message Manipulation via a Man-in-the-Middle attack. It affects the client across Windows, macOS, Linux, iOS, Android, and WebClient platforms, targeting the Strategy sync, HTTP API client, and config options engine modules. The flaw is associated with source files src/hbbs_http/sync.rs and hbb_common/src/config.rs, as well as routines such as the Strategy merge loop in sync.rs and Config::set_options(). This issue impacts RustDesk Client versions through 1.4.5 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-657.
The vulnerability can be exploited by an attacker positioned to perform a Man-in-the-Middle interception on the network path to the RustDesk server. No privileges or user interaction are required, though exploitation demands high attack complexity, consistent with establishing and maintaining a MITM position. Successful manipulation of API messages in strategy sync or config options can result in high-impact effects on confidentiality, integrity, and availability.
Advisories and documentation on mitigation are available at the following references: https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub, https://rustdesk.com/docs/en/self-host/client-configuration/advanced-settings/, and https://www.vulsec.org/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9826
Vulnerability Data
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Strategy sync, HTTP API client, config options engine modules) allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files src/hbbs_http/sync.Rs, hbb_common/src/config.Rs and…
more
program routines Strategy merge loop in sync.Rs, Config::set_options(). This issue affects RustDesk Client: through 1.4.5.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 5 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Explicitly requires application of security and privacy engineering principles throughout the lifecycle, structurally preventing their violation.
Separation of duties is a core secure design principle whose mandated implementation directly stops the violation from occurring.
Least privilege is a fundamental secure design principle whose enforcement prevents the violation from being introduced.
Mandates separation of user and system functionality, a classic secure design principle that stops the violation at design time.
Requires isolation of security functions, directly preventing violation of that established design principle.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly mandates integration of secure development practices including design principles across the SDLC.
Establishes risk-management policy that can embed secure design expectations at the organizational level.
Explicitly requires incorporating least privilege, one key secure design principle.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure system architecture and engineering principles are the explicit embodiment of the secure design principles violated by CWE-657.
A secure development life cycle directly requires adherence to established secure design principles.
Security testing can detect violations of secure design principles before release.
Embedding security in project management helps enforce secure design principles from the outset.
Secure coding practices help realize secure design principles at implementation time.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Ubuntu 22.04 (1 rule)
- V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. prevents CWE-657
Ubuntu 24.04 (1 rule)
- V-270748 Ubuntu 24.04 LTS must ensure only users who need access to security functions are part of sudo group. prevents CWE-657
Windows Server 2016 (2 rules)
- V-224992 Domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
- V-224993 PKI certificates associated with user accounts must be issued by the DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
Windows Server 2019 (2 rules)
- V-205646 Windows Server 2019 domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
- V-205647 Windows Server 2019 PKI certificates associated with user accounts must be issued by a DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
Windows Server 2022 (2 rules)
- V-254413 Windows Server 2022 domain Controller PKI certificates must be issued by the DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657
- V-254414 Windows Server 2022 PKI certificates associated with user accounts must be issued by a DoD PKI or an approved External Certificate Authority (ECA). prevents CWE-657