CVE-2026-30794: 
NixOS vulnerability analysis and mitigation

CVE-2026-30794 is an Improper Certificate Validation vulnerability (CWE-295) in the RustDesk Client's HTTP API client and TLS transport modules, affecting all platforms (Windows, macOS, Linux, iOS, Android) through version 1.4.5. The flaw enables Adversary-in-the-Middle (AiTM) attacks by disabling TLS certificate verification via danger_accept_invalid_certs(true) in the TLS retry logic. It was published on March 5, 2026, and assigned by VULSec. The vulnerability carries a CVSS v3.1 score of 8.1 (High) and a CVSS v4.0 score of 9.1 (Critical) (Feedly, ENISA EUVD).

The root cause is the use of danger_accept_invalid_certs(true) within the TLS retry logic in src/hbbs_http/http_client.rs, which instructs the Rust TLS stack to accept any certificate regardless of validity, chain of trust, or hostname match (CWE-295). This means that when an initial TLS handshake fails, the client retries the connection with certificate validation entirely disabled, creating a window for a network-positioned attacker to present a forged or self-signed certificate and intercept the session. The attack requires no privileges or user interaction but does require a network-adjacent or on-path position between the client and the RustDesk relay/rendezvous server. A public proof-of-concept document detailing attack chains — including rustdesk://config/ infrastructure hijack, Strategy API payload injection, and credential exfiltration via sync.rs heartbeat loops — has been published (Feedly PoC).

A network-positioned attacker can silently intercept and decrypt all TLS-protected communications between the RustDesk client and its server infrastructure, exposing session credentials, remote desktop traffic, and configuration data. The attacker can also modify data in transit — injecting malicious configuration payloads (e.g., via rustdesk://config/ deep links or Strategy API fields such as whitelist, access-mode, enable-keyboard) to hijack client behavior or escalate access. Combined with credential exfiltration through heartbeat loops, successful exploitation can lead to full compromise of managed remote desktop sessions and potentially lateral movement to connected endpoints (Feedly, ENISA EUVD).

A proof-of-concept exploit document with detailed, step-by-step attack chains was publicly released and indexed by NVD on March 25, 2026, and is rated high confidence (Feedly PoC). As of the latest update, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.022% (0.000220), indicating low but non-zero automated exploitation probability. No specific threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify RustDesk client deployments (version ≤ 1.4.5) on target networks using network scanning or by observing RustDesk-specific traffic patterns on ports used by the rendezvous/relay server.
2. Network Positioning: Establish an on-path (AiTM) position between the RustDesk client and its configured relay or rendezvous server using ARP spoofing, rogue Wi-Fi access point, BGP hijacking, or DNS poisoning.
3. TLS Interception: Present a forged or self-signed TLS certificate to the client. Because the client retries failed TLS handshakes with danger_accept_invalid_certs(true), it will accept the attacker's certificate without warning.
4. Session Interception: Decrypt and inspect the now-plaintext HTTP API traffic, capturing authentication tokens, session credentials, and configuration data exchanged between the client and server.
5. Configuration Injection: Inject malicious payloads via the Strategy API (targeting fields such as whitelist, access-mode, enable-keyboard) or craft rustdesk://config/ deep link URIs to redirect the client to attacker-controlled infrastructure.
6. Credential Exfiltration: Monitor and capture credentials transmitted through sync.rs heartbeat loops, enabling persistent access to remote desktop sessions or further lateral movement to connected systems (Feedly PoC).

• Network: Unexpected TLS certificates presented to RustDesk clients that are self-signed or issued by unknown CAs; TLS connections to RustDesk relay/rendezvous servers that complete after an initial handshake failure (retry pattern); unusual outbound connections from RustDesk client processes to non-standard relay server IPs.
• Logs: TLS handshake errors followed immediately by successful connections in RustDesk client logs, indicating the danger_accept_invalid_certs retry path was triggered; unexpected rustdesk://config/ URI handler invocations in system or application logs.
• Process/Behavior: RustDesk client connecting to relay servers not matching the configured or expected server addresses; unexpected changes to RustDesk configuration files (e.g., modified access-mode, whitelist, or enable-keyboard settings) without user action.
• File System: Unexpected modifications to RustDesk configuration files on disk reflecting injected Strategy API values (Feedly PoC).

Upgrade RustDesk Client to a version newer than 1.4.5 as soon as a patched release is available — the GitHub repository shows version 1.4.7 was released on June 2, 2026, and should be evaluated for this fix (RustDesk GitHub). As an immediate workaround, remove or disable the danger_accept_invalid_certs(true) configuration from the TLS retry logic in src/hbbs_http/http_client.rs if building from source. Implement network-level controls to restrict RustDesk traffic to known, trusted relay servers and deploy TLS inspection or monitoring to detect anomalous certificate usage. Organizations should also consider certificate pinning for all TLS connections used by the client (ENISA EUVD).

A technical write-up was published by Infinitsec titled "CVE-2026-30794: RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure," providing additional analysis of the vulnerability (Infinitsec). The vulnerability was assigned by VULSec and tracked by ENISA under EUVD-2026-9828. No official public statement from the RustDesk development team specifically addressing CVE-2026-30794 has been identified beyond the repository's general security policy.