CVE-2026-30794
Published: 05 March 2026
Summary
CVE-2026-30794 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Rustdesk Rustdesk. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 12.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-17 (Public Key Infrastructure Certificates) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates establishment and validation of PKI certificates, directly preventing acceptance of invalid certificates that enable AiTM attacks in RustDesk's TLS transport.
Requires timely identification, reporting, and remediation of flaws like improper certificate validation in RustDesk client versions through 1.4.5.
Enforces cryptographic protection for transmission confidentiality and integrity using properly implemented TLS, addressing the vulnerability's exploitation via intercepted traffic.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability description explicitly states it enables Adversary-in-the-Middle (AiTM) attacks via improper certificate validation (danger_accept_invalid_certs) in the TLS client, allowing traffic interception and server impersonation without system-level trust subversion.
NVD Description
Improper Certificate Validation vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (HTTP API client, TLS transport modules) allows Adversary in the Middle (AiTM). This vulnerability is associated with program files src/hbbs_http/http_client.Rs and program routines TLS retry…
more
with danger_accept_invalid_certs(true). This issue affects RustDesk Client: through 1.4.5.
Deeper analysisAI
CVE-2026-30794 is an Improper Certificate Validation vulnerability (CWE-295) in the RustDesk Client (rustdesk-client), affecting versions through 1.4.5 on Windows, macOS, Linux, iOS, and Android. The flaw exists in the HTTP API client and TLS transport modules, specifically tied to the program file src/hbbs_http/http_client.rs and TLS retry routines that invoke danger_accept_invalid_certs(true). Published on 2026-03-05, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and enables Adversary-in-the-Middle (AiTM) attacks by failing to properly validate certificates.
An attacker with network access can exploit this vulnerability by intercepting traffic between the RustDesk Client and its server, requiring no privileges or user interaction but demanding high attack complexity, such as manipulating the network path. Successful exploitation allows the adversary to impersonate the server, leading to high impacts on confidentiality, integrity, and availability, including potential interception, modification, or disruption of remote desktop sessions.
Mitigation details are outlined in advisories linked from the following references: https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub, https://github.com/rustdesk/rustdesk, and https://www.vulsec.org/.
Details
- CWE(s)