CVE-2026-109953
Received Received - Intake

Insufficient Credential Protection in FreeRDP via CredSSP Delegation

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode TSPasswordCreds and the Client Info PDU to obtain reusable administrative domain, username, and password values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109953
EUVD
EUVD-2026-98657

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP 3.0.0 before 3.32.0 has a flaw where the /restricted-admin option fails to block credential delegation. This sends the user's cleartext domain, username, and password to the RDP server during authentication. Attackers with access to the server or network can decode these credentials and reuse them.

Detection Guidance

To detect this vulnerability, check FreeRDP versions 3.0.0 through 3.31.0 using the command: freerdp /version. If the version is within this range, the system is vulnerable. Monitor network traffic for CredSSP authentication attempts with cleartext credentials during RDP sessions.

Impact Analysis

If you use FreeRDP versions 3.0.0 to 3.31.0 with /restricted-admin and a plaintext password, your credentials could be exposed. Attackers may gain administrative access to your domain if they compromise the RDP server or intercept traffic.

Compliance Impact

This vulnerability may violate compliance requirements that mandate protection of sensitive credentials, such as GDPR's data security principles or HIPAA's safeguards for protected health information. Exposure of administrative credentials could lead to unauthorized access and data breaches.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later immediately. Avoid using the /restricted-admin option with plaintext passwords. Disable credential delegation by adding -credentials-delegation to the command line. Ensure RDP servers use trusted certificates to prevent man-in-the-middle attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109953. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart