CVE-2026-30793
CSRF in RustDesk Client URI Handler Enables Privilege Escalation
Publication date: 2026-03-05
Last updated on: 2026-03-25
Assigner: VULSec Labs
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rustdesk | rustdesk | to 1.4.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue found in the RustDesk Client (rustdesk-client) on multiple platforms including Windows, MacOS, Linux, iOS, and Android. It involves the Flutter URI scheme handler and FFI bridge modules, specifically in program files such as flutter/lib/common.Dart, src/flutter_ffi.Rs, and the URI handler for rustdesk://password/. The vulnerability allows an attacker to perform privilege escalation by exploiting the bind.MainSetPermanentPassword() routine.
How can this vulnerability impact me? :
This vulnerability can lead to privilege escalation, meaning an attacker could gain higher-level access or control over the RustDesk Client than intended. This could allow unauthorized actions or changes within the application, potentially compromising the security and integrity of the system where the client is installed.