CVE-2026-30785: 
NixOS vulnerability analysis and mitigation

CVE-2026-30785 is a credential/token disclosure vulnerability in RustDesk Client affecting the password security module, config encryption, and machine UID modules across Windows, macOS, and Linux. It combines prototype pollution (CWE-1321), use of password hash with insufficient computational effort (CWE-916), storing passwords in a recoverable format (CWE-257), and nonce/key reuse in encryption (CWE-323). All versions of RustDesk Client through 1.4.5 are affected. The vulnerability was published on March 5, 2026, and assigned by VULSec. It carries a CVSS v3.1 score of 5.5 (Medium) and a CVSS v4.0 score of 8.2 (High) (Feedly, EUVD).

The vulnerability resides in several source files and routines within the hbb_common library: password_security.rs, config.rs, lib.rs (specifically get_uuid()), and machine-uid/src/lib.rs. The affected functions — symmetric_crypt(), encrypt_str_or_original(), decrypt_str_or_original(), get_uuid(), and get_machine_id() — use weak cryptographic primitives, reuse nonces/key pairs, and derive encryption keys from world-readable machine identifiers. This means that any local user who can read the machine's UID (which is not adequately protected) can reconstruct the encryption key and decrypt stored passwords or configuration secrets. The prototype pollution aspect (CWE-1321) may further allow manipulation of configuration object attributes to influence security-sensitive logic (Feedly, GitHub Discussion #9229).

A local low-privileged attacker can retrieve embedded sensitive data — including RustDesk permanent password hashes and machine identifiers — by exploiting the weak cryptographic protections in the client's encryption and configuration modules. There is no integrity or availability impact, but the confidentiality impact is rated High for both the vulnerable system and any downstream systems (CVSS v4.0 SC:H). Extracted credentials could enable lateral movement by allowing an attacker to authenticate to other machines managed via RustDesk, and machine UIDs could be used to further compromise device identity or session tokens (Feedly, EUVD).

A proof-of-concept exploit document is publicly available, detailing step-by-step attack chains including specific payloads such as Base64-reversed configuration strings, URI handler abuse (rustdesk://password/<PWD> and rustdesk://config/), stop-service payload injection, and strategy override sequences (PoC Document). There is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.007% (very low probability of exploitation in the near term). The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires local access with low privileges, limiting the attack surface compared to network-exploitable vulnerabilities (Feedly).

1. Reconnaissance: Identify systems running RustDesk Client version 1.4.5 or earlier on Windows, macOS, or Linux. Confirm local access with at least low-privileged user credentials.
2. Locate configuration files: Access the RustDesk configuration file (e.g., ~/.config/rustdesk/RustDesk.toml on Linux, or equivalent paths on Windows/macOS) which stores the encrypted password and enc_id fields.
3. Retrieve machine UID: Use the get_machine_id() or get_uuid() routines (or equivalent system calls) to obtain the machine's UID, which is world-readable and serves as the encryption key derivation input.
4. Reconstruct encryption key: Leverage knowledge of the weak symmetric_crypt() / encrypt_str_or_original() implementation — which uses the machine UID and a fixed or reused nonce — to reconstruct the encryption key.
5. Decrypt stored credentials: Apply the reconstructed key to decrypt the password and enc_id fields from the TOML configuration file, recovering the plaintext permanent password and machine identifier.
6. Abuse URI handlers (optional): Use the rustdesk://password/<PWD> or rustdesk://config/ URI handlers with crafted Base64-reversed payloads to inject configuration overrides or override access controls (e.g., setting access-mode, whitelist, enable-keyboard fields).
7. Lateral movement: Use the recovered RustDesk password to authenticate to other machines managed via RustDesk without user confirmation, enabling unauthorized remote access (PoC Document, Feedly).

• File System: Unexpected read access to ~/.config/rustdesk/RustDesk.toml (Linux/macOS) or %APPDATA%\RustDesk\config\RustDesk.toml (Windows) by non-RustDesk processes or low-privileged users; presence of scripts or tools designed to parse TOML files in user directories.
• Logs: System audit logs (e.g., auditd on Linux, Windows Security Event Log) showing low-privileged user access to RustDesk configuration files or machine UID retrieval calls; RustDesk logs showing unexpected URI handler invocations (rustdesk://password/ or rustdesk://config/).
• Network: Unexpected outbound RustDesk remote desktop sessions initiated from a host, particularly to new or unknown peer IDs; connections to RustDesk relay servers from hosts that do not normally initiate remote sessions.
• Process: Unusual processes reading /etc/machine-id (Linux) or equivalent machine UID sources outside of normal RustDesk operation; command-line invocations of rustdesk.exe --password or rustdesk --get-id by non-administrative users (Feedly, PoC Document).

Upgrade RustDesk Client to a version newer than 1.4.5, which addresses the weak cryptographic protections in the affected modules (Feedly, EUVD). As an interim workaround, restrict filesystem permissions on RustDesk configuration files (e.g., RustDesk.toml) so that only the owning user or administrator can read them, reducing the risk of credential extraction by other local users. Audit all systems running RustDesk Client 1.4.5 or earlier for signs of unauthorized access to configuration files or unexpected remote sessions. Avoid deploying RustDesk permanent passwords via plaintext command-line arguments or unprotected configuration files in shared environments (GitHub Discussion #9229).

Community discussions on the RustDesk GitHub repository (dating back to 2023–2024) highlighted concerns about the weak password storage and encryption scheme, with users noting that passwords stored in TOML files could be read by any local user and that the encryption appeared to be tied to a machine identifier (GitHub Discussion #9229, GitHub Discussion #4979). A technical blog post from infinitsec.net specifically analyzed CVE-2026-30785, describing how RustDesk encrypts local passwords with a world-readable machine ID and a fixed zero nonce (infinitsec.net). No official vendor patch advisory or formal statement from the RustDesk maintainers has been publicly identified at this time.