CVE-2026-30797
Published: 05 March 2026
Summary
CVE-2026-30797 is a high-severity Exposed Dangerous Method or Function (CWE-749) vulnerability in Rustdesk Rustdesk. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-8 (Transmission Confidentiality and Integrity).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations to prevent unauthorized access and manipulation of application API messages via the missing authorization in the URI scheme handler and importConfig() routine.
Protects the confidentiality and integrity of transmitted configuration data over the network to mitigate Man-in-the-Middle interception and manipulation.
Validates inputs from the URI handler to detect and block manipulated application API messages before they affect the RustDesk client.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization in URI/config handler directly enables MITM-based manipulation of application API messages (T1557 Adversary-in-the-Middle; T1565.002 Transmitted Data Manipulation).
NVD Description
Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, config import modules) allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files flutter/lib/common.Dart and program routines importConfig()…
more
via URI handler. This issue affects RustDesk Client: through 1.4.5.
Deeper analysisAI
CVE-2026-30797 is a Missing Authorization vulnerability in the RustDesk Client (rustdesk-client) on Windows, macOS, Linux, iOS, and Android platforms, affecting versions through 1.4.5. The flaw exists in the Flutter URI scheme handler and config import modules, specifically within the flutter/lib/common.dart file and the importConfig() routine accessed via the URI handler. It enables Application API Message Manipulation through a Man-in-the-Middle attack and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), linked to CWEs-749 and CWE-862.
The vulnerability can be exploited by remote attackers over the network, requiring high attack complexity but no privileges or user interaction. A successful Man-in-the-Middle interception allows manipulation of Application API messages, resulting in high impacts to confidentiality, integrity, and availability of the affected client.
Mitigation details are outlined in related advisories available at https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub, https://rustdesk.com/docs/en/client/, and https://www.vulsec.org/.
Details
- CWE(s)