CVE-2026-114047: 
Wolfi vulnerability analysis and mitigation

CVE-2026-114047 is an improper TLS certificate validation vulnerability in the FreeRDP proxy component, classified as FreeRDP Proxy Improper TLS Certificate Validation. When no verification module is configured, the proxy's certificate callback accepts any presented target TLS certificate — including self-signed or wrong-hostname certificates — allowing a network-positioned attacker to impersonate the RDP target and intercept proxied session data. It affects FreeRDP versions 2.0.0 through 3.31.x, with version 3.32.0 being the first patched release. The vulnerability was published on October 21, 2026, with a CVSS v3.1 score of 6.8 (Medium) and a CVSS v4.0 score of 7.6 (High) (GitHub Advisory, FreeRDP Advisory, Red Hat Bugzilla).

The root cause is CWE-295 (Improper Certificate Validation): the FreeRDP proxy's outbound TLS certificate callback defaults to accepting any certificate when no proxy module is present to veto it, rather than failing closed with standard chain and hostname verification. An attacker with a network-adjacent position (e.g., via ARP spoofing, DNS poisoning, or rogue routing) can intercept the proxy's outbound TCP connection to the RDP target and complete a TLS handshake using a self-signed or mismatched-hostname certificate. Exploitation requires that the deployment uses FreeRDP proxy with TLS to its target, has no certificate-validating module configured, the attacker can intercept the proxy's outbound connection, and a user initiates a proxied session. A live proxy replay demonstrated that the default no-module configuration transmitted 395 post-TLS RDP bytes to the attacker-controlled endpoint, while a properly configured rejecting module sent zero bytes (FreeRDP Advisory).

Successful exploitation allows an unauthenticated, network-positioned attacker to perform a man-in-the-middle attack against proxied RDP sessions, capturing all post-TLS session data including user credentials, keystrokes, and sensitive information transmitted over the RDP connection. Both confidentiality and integrity are highly impacted — the attacker can read and potentially manipulate session data — while availability is unaffected. The scope is limited to the vulnerable proxy component itself, but credential theft could enable lateral movement to the RDP target systems and beyond (FreeRDP Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is 0.0, reflecting low current exploitation probability (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires specific preconditions — network positioning, a misconfigured proxy deployment, and user interaction — which raise the practical bar for opportunistic attackers.

1. Reconnaissance: Identify deployments using FreeRDP proxy (versions 2.0.0–3.31.x) with TLS-enabled outbound connections to RDP targets and no certificate verification module configured. This may be inferred from network scanning or organizational intelligence.
2. Network Positioning: Gain a man-in-the-middle position on the network path between the FreeRDP proxy and its configured RDP target using techniques such as ARP spoofing, DNS poisoning, BGP hijacking, or rogue Wi-Fi/switch access.
3. Intercept Outbound Connection: Redirect the proxy's outbound TCP connection (typically port 3389) to an attacker-controlled host using the established network-level interception.
4. Present Fraudulent TLS Certificate: Complete a TLS handshake with the FreeRDP proxy using a self-signed certificate or a certificate with a mismatched hostname. Because no verification module is configured, the proxy's callback accepts the certificate without validation.
5. Capture Session Data: Relay or record the post-TLS RDP protocol bytes transmitted by the proxy, extracting credentials, keystrokes, clipboard contents, and other sensitive session data as users initiate proxied RDP sessions (FreeRDP Advisory).

• Network: Unexpected TLS handshakes on port 3389 originating from the FreeRDP proxy to IP addresses not matching the configured RDP target; TLS certificates presented to the proxy with mismatched Common Names or self-signed issuers in proxy TLS logs.
• Network: ARP table anomalies or duplicate MAC address entries on the network segment between the FreeRDP proxy and its RDP target, suggesting ARP spoofing.
• Logs: FreeRDP proxy logs showing successful TLS connections to the target where the certificate subject/issuer does not match the expected RDP server identity; absence of certificate rejection log entries when a verification module should be active.
• Logs: Unusual volume of RDP session data transmitted to an unexpected destination IP, or session data appearing in network captures destined for a non-target host.
• Process/Configuration: FreeRDP proxy configuration files (proxy.ini or equivalent) lacking a [Modules] section or certificate verification module entry, confirming the vulnerable default state (FreeRDP Advisory).

Upgrade FreeRDP to version 3.32.0 or later, which is the patched release addressing this vulnerability (FreeRDP Advisory, GitHub Advisory). As an interim workaround, configure a proxy module that explicitly validates and rejects certificates failing standard chain and hostname verification — the proxy should be configured to fail-closed, requiring an explicit verifier decision rather than defaulting to acceptance. Additionally, implement network segmentation to restrict access to the proxy's outbound RDP path, and consider layering VPN or other encrypted transport to provide defense-in-depth against interception attacks (FreeRDP Advisory).

The vulnerability was reported by security researchers Kushalkhemka, mayank-jangid-moon, and skigeek16, with opensec-intelligence credited as a tool contributor, and was published by FreeRDP maintainer akallabeth (FreeRDP Advisory). Red Hat tracked the issue via Bugzilla (Bug 2558040) and assigned it medium priority/severity for their product lines (Red Hat Bugzilla). No significant broader media coverage or notable social media commentary has been identified at this time.