CVE-2026-114047

Received Received - Intake

Improper Certificate Validation in FreeRDP Proxy

Publication date: 2026-10-21

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-22

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114047

EUVD

EUVD-2026-106998

Affected Vendors & Products

Vendor	Product	Version / Range
FreeRDP	FreeRDP	2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

FreeRDP versions 2.0.0 to 3.31.0 have an improper TLS certificate validation flaw in the proxy component. When no verification module is configured, the proxy accepts untrusted TLS certificates, including self-signed or wrong-hostname certificates. Network attackers can intercept the proxy's connection to the RDP target and impersonate it by presenting a malicious certificate, allowing interception of proxied session data.

Detection Guidance

To detect this vulnerability, check FreeRDP versions between 2.0.0 and 3.31.0. Run 'xfreerdp --version' or 'freerdp-proxy --version' to verify the installed version. Inspect proxy configurations for missing certificate validation modules. Monitor network traffic for unexpected TLS handshakes or mismatched certificates.

Impact Analysis

An attacker could intercept your proxied RDP session, gaining access to sensitive session information. This could lead to unauthorized access to data transmitted during the session, potentially exposing confidential or sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations using affected FreeRDP versions may face regulatory penalties or legal consequences due to data breaches.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later. Configure the proxy to enforce certificate chain and hostname verification for outbound targets. Use fail-closed external management with explicit certificate validation. Disable proxy functionality if unused.

Hi! I’m here to help you understand CVE-2026-114047. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...