CVE-2026-30789: 
NixOS vulnerability analysis and mitigation

CVE-2026-30789 is an authentication bypass vulnerability in RustDesk Client affecting all supported platforms (Windows, macOS, Linux, iOS, and Android) through version 1.4.5. The flaw combines Authentication Bypass by Capture-replay (CWE-294) and Use of Password Hash With Insufficient Computational Effort (CWE-916), allowing attackers to reuse captured session IDs to impersonate authenticated users without valid credentials. It was published on March 5, 2026, and assigned by VULSec. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (Feedly, ENISA EUVD).

The root cause lies in the client login and peer authentication modules within src/client.rs, specifically in the hash_password() function and the login proof construction routine. The authentication proof is generated without incorporating a client-side nonce, meaning the resulting hash or proof value is static and replayable across sessions. An attacker positioned to intercept network traffic (e.g., via a man-in-the-middle position) can capture a valid authentication proof and replay it to authenticate as the victim without knowing the actual password. No privileges or user interaction are required, and the attack is executable remotely over the network (Feedly, InfinitSec).

Successful exploitation allows an attacker to fully bypass authentication and gain unauthorized access to a victim's remote desktop session, achieving high confidentiality and integrity impact across all supported platforms. An attacker can impersonate legitimate users, view and control remote systems, exfiltrate sensitive data, and potentially pivot to other systems accessible via the compromised remote desktop connection. Because no user interaction or prior privileges are required, the vulnerability is easily weaponizable at scale and poses a significant risk to enterprise environments relying on RustDesk for remote access (Feedly, ENISA EUVD).

As of the time of reporting, there is no confirmed public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). A Google Docs page referenced as a potential PoC was found to contain no actual exploit content. The EPSS score is approximately 0.056% (0.000560), indicating a currently low probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE (Feedly, ENISA EUVD).

1. Reconnaissance: Identify targets running RustDesk Client version 1.4.5 or earlier on any supported platform (Windows, macOS, Linux, iOS, Android) using network scanning or service fingerprinting tools.
2. Network Interception: Position between the RustDesk client and server (or relay) using ARP spoofing, rogue Wi-Fi, or other adversary-in-the-middle techniques to intercept authentication traffic.
3. Capture Authentication Proof: Monitor the RustDesk protocol traffic and capture the authentication proof (hash) generated by hash_password() and the login proof construction routine in src/client.rs. Because no client-side nonce is included, this proof is static and reusable.
4. Replay the Captured Proof: Replay the captured authentication proof to the RustDesk server or peer, bypassing the authentication check and gaining access to the target's remote desktop session without knowing the actual password.
5. Achieve Objective: Once authenticated, control the remote desktop session to exfiltrate data, install malware, or use the compromised host as a pivot point for lateral movement (Feedly, InfinitSec).

• Network: Duplicate or replayed authentication handshake packets observed in RustDesk protocol traffic; unexpected authentication attempts from IP addresses not associated with known users; RustDesk relay or peer connections originating from unusual geographic locations or IP ranges.
• Logs: Multiple successful authentication events for the same session ID from different source IPs within a short time window; authentication successes without corresponding prior connection initiation from the legitimate client.
• Process/Behavior: Unexpected remote desktop sessions active on endpoints when no legitimate user has initiated a connection; unusual file access, process execution, or clipboard activity during RustDesk sessions not attributable to the authorized user.
• File System: New files, scripts, or executables dropped on remote systems during or after RustDesk sessions that cannot be attributed to authorized activity (Feedly).

No official patch has been released by the RustDesk vendor as of the time of reporting; all RustDesk Client versions through 1.4.5 are affected (Feedly, ENISA EUVD). Organizations should immediately assess whether RustDesk deployments are essential and, if so, implement network segmentation to restrict RustDesk traffic to trusted, isolated network segments. Additional compensating controls include deploying network-level multi-factor authentication at the perimeter, enforcing strict firewall rules to limit RustDesk relay/peer communication, and maintaining detailed audit logs of all RustDesk sessions. Monitor the official RustDesk documentation and security advisories at https://rustdesk.com/docs/en/client/ for patch availability and apply updates as soon as they are released.

The vulnerability was reported by VULSec and catalogued by ENISA under EUVD-2026-9834. A technical write-up was published by InfinitSec detailing the missing client-side nonce in the authentication proof construction (InfinitSec). No significant vendor statement, major media coverage, or notable community debate has been identified beyond standard vulnerability database aggregation at this time (Feedly).