CVE Feed

    Dashboard / CVE / CVE-2026-57850

    CVE-2026-57850

    RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved for a full Remote session. An authenticated remote peer can exploit this missing scope check to act outside its granted scope, injecting out-of-scope control messages to observe and control the host beyond the permissions it was given.

    Published:Jul 10, 2026
    Last Modified:Aug 11, 2026
    EPS:Jul 10, 2026
    EPSS Score:0.00389
    CVSS Score:8.3

    Affected Products

    Vendor
    Rustdesk
    Product
    Rustdesk

    Exploits

    https://github.com/sn0x-sharma/CVE-2026-57850

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-73108 (CVSS 8.7) — RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCod…
    CVE-2026-73102 (CVSS 6.9) — RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste…
    CVE-2026-76840 (CVSS 8.5) — RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without…
    CVE-2026-58056 (CVSS 7.2) — RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized conne…
    CVE-2026-30785 (CVSS 8.2) — Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Has…
    CVE-2026-30783 (CVSS 4.8) — A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, Web…
    CVE-2026-30789 (CVSS 5.7) — Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication …
    CVE-2026-30798 (CVSS 8.2) — Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in r…
    CVE-2026-30797 (CVSS 9.3) — Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linu…
    CVE-2026-30795 (CVSS 8.7) — Cleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-clie…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High