CVE-2026-30791: 
NixOS vulnerability analysis and mitigation

CVE-2026-30791 is a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the RustDesk Client that allows unauthenticated remote attackers to retrieve embedded sensitive data from configuration strings. It affects RustDesk Client versions through 1.4.5 across all supported platforms: Windows, macOS, Linux, iOS, Android, and WebClient. The vulnerability resides in the Config import, URI scheme handler, and CLI --config modules, specifically in flutter/lib/common.dart and hbb_common/src/config.rs via the parseRustdeskUri() and importConfig() routines. It was published on March 5, 2026, and assigned by VULSec. The CVSS v3.1 base score is 7.5 (High), and the CVSS v4.0 base score is 8.7 (High) (Feedly, ENISA EUVD).

The root cause is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-684 (Incorrect Provision of Specified Functionality). RustDesk Client accepts pseudo-encrypted configuration strings without proper cryptographic validation, meaning the encoding/encryption applied to config data can be trivially reversed or bypassed. The affected code paths — parseRustdeskUri() and importConfig() — process configuration data delivered via URI scheme handlers (e.g., rustdesk://), CLI --config flags, or config import flows without enforcing cryptographic integrity. Additionally, the PoC documentation reveals that if a TLS handshake fails, the client automatically retries with danger_accept_invalid_certs(true), and that sync.rs pushes preset-address-book-password in raw JSON heartbeat payloads, further compounding the exposure (Feedly, PoC Document).

Successful exploitation allows an unauthenticated network attacker to retrieve sensitive embedded data from RustDesk configuration strings, including credentials, server addresses, and passwords (e.g., preset-address-book-password). The confidentiality impact is rated High with no integrity or availability impact, but exposed credentials could enable lateral movement — for example, by re-homing a client to an attacker-controlled server or hijacking remote desktop sessions. The vulnerability affects all major platforms (Windows, macOS, Linux, iOS, Android, WebClient), significantly broadening the attack surface for enterprise and personal deployments alike (Feedly, ENISA EUVD).

A proof-of-concept exploit document is publicly available, containing detailed, reproducible attack sequences including URI handler exploitation, credential exfiltration flows, and configuration hijacking mechanisms (PoC Document). The vulnerability requires no authentication, no user interaction, and no special privileges, making it trivially exploitable over the network. As of the latest available data, there is no confirmed evidence of active in-the-wild exploitation, no threat actor attribution, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.028% (0.000280), indicating low but non-zero probability of exploitation in the near term (Feedly).

1. Reconnaissance: Identify RustDesk Client deployments running version 1.4.5 or earlier. Targets can be identified via network scanning or by observing rustdesk:// URI handler registrations on endpoints.
2. Craft malicious URI: Construct a rogue rustdesk:// URI containing a crafted configuration payload that exploits the weak cryptographic encoding in parseRustdeskUri() to embed attacker-controlled server addresses or extract sensitive config values.
3. Deliver the URI: Deliver the malicious URI to the victim via phishing email, malicious web page, or any mechanism that triggers the registered URI scheme handler on the target system (e.g., a link click).
4. Re-home the client: The rogue URI forces the client to re-home to an attacker-controlled server via the FFI layer, bypassing Rust-level privilege checks (e.g., by calling FFI bind.mainSetPermanentPassword directly).
5. Exploit TLS fallback: If the attacker's server does not present a valid TLS certificate, the client automatically retries the connection with danger_accept_invalid_certs(true), enabling a man-in-the-middle position.
6. Harvest credentials: Intercept heartbeat payloads from sync.rs which transmit preset-address-book-password in plaintext JSON, or decode the weakly encrypted configuration strings to extract embedded credentials and server addresses.
7. Lateral movement: Use harvested credentials to authenticate to legitimate RustDesk servers or pivot to other systems accessible via the compromised remote desktop infrastructure (PoC Document, Feedly).

• Network: Outbound connections from RustDesk client processes to unexpected or unknown server addresses (indicating client re-homing); TLS connections to servers with invalid/self-signed certificates from the RustDesk process; heartbeat traffic containing plaintext JSON with preset-address-book-password fields to non-standard servers.
• Logs: RustDesk application logs showing parseRustdeskUri() or importConfig() invocations with externally supplied URI or config strings; TLS handshake failure events followed immediately by retry with certificate validation disabled (danger_accept_invalid_certs).
• Process/Behavior: RustDesk client process initiating connections to servers not matching the configured/expected relay or rendezvous server; unexpected invocation of the rustdesk:// URI handler from browser or email client processes.
• File System: Unexpected modification of RustDesk configuration files (e.g., RustDesk2.toml) with altered server addresses or passwords not set by the local administrator (PoC Document, Feedly).

Users should update RustDesk Client to a version newer than 1.4.5 as soon as a patched release is available from the vendor; patch status has not been officially confirmed by RustDesk at the time of this report. As interim workarounds: restrict or disable the rustdesk:// URI scheme handler registration on endpoints where it is not required; implement network controls to block RustDesk client connections to unauthorized relay/rendezvous servers; and review and rotate any credentials (passwords, server keys) that may have been exposed through configuration data. Organizations should also monitor for unexpected configuration changes in RustDesk2.toml and audit RustDesk server address settings across managed endpoints (Feedly, ENISA EUVD).

The vulnerability was reported by VULSec and published on March 5, 2026. A technical write-up was published by Infinit Security detailing how RustDesk Client accepts pseudo-encrypted config strings without cryptographic validation (Infinit Security). The CVE received automated coverage across vulnerability tracking platforms including Vulners, CVEFeed, and CIRCL, and was noted on Bluesky by CVE tracking accounts. No official public statement from the RustDesk development team has been identified at this time.