CVE-2026-30797: 
NixOS vulnerability analysis and mitigation

CVE-2026-30797 is a Missing Authorization vulnerability in the RustDesk Client's Flutter URI scheme handler and configuration import modules, classified under CWE-749 (Exposed Dangerous Method or Function) and CWE-862 (Missing Authorization). It affects RustDesk Client versions through 1.4.5 across Windows, macOS, Linux, iOS, and Android platforms. The vulnerability was published on March 5, 2026, and assigned by VULSec. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 9.3 (Critical) (Feedly, ENISA EUVD).

The root cause is a missing authorization check in the importConfig() function within flutter/lib/common.dart, which is invoked via the RustDesk URI scheme handler (e.g., rustdesk://config/ and rustdesk://password/). An attacker positioned as a man-in-the-middle can craft malicious URI scheme invocations to manipulate API messages, forcibly re-home the client to an attacker-controlled server, or overwrite the client's password without privilege checks. The rustdesk://config/ URI silently redirects the client to a rogue relay/rendezvous server, while rustdesk://password/<PWD> bypasses privilege checks via FFI. Additionally, TLS fallback using danger_accept_invalid_certs enables interception, and the Strategy API allows a rogue server to override security policies (Feedly, PoC Document).

Successful exploitation allows an unauthenticated attacker to arbitrarily manipulate client configuration, redirect the RustDesk client to an attacker-controlled infrastructure, overwrite authentication credentials, and exfiltrate plaintext credentials via heartbeat synchronization. The impact spans confidentiality, integrity, and availability — attackers can gain unauthorized remote access to managed endpoints, intercept remote desktop sessions, and persistently control victim machines across all supported platforms (Windows, macOS, Linux, iOS, Android). The cross-platform scope significantly broadens the attack surface, and the ability to silently re-home clients to rogue servers enables persistent, stealthy compromise (Feedly, PoC Document).

A detailed proof-of-concept exploit document was published on March 25, 2026, providing step-by-step exploitation instructions for multiple attack chains including infrastructure hijack via rustdesk://config/, password overwrite via rustdesk://password/ deep links, MiTM via TLS fallback, and credential exfiltration via heartbeat sync (PoC Document). The EPSS score is approximately 0.039% (low probability of near-term exploitation in the wild), and there is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing (Feedly). No threat actor attribution has been reported at this time. No official patch has been released as of the time of this report.

1. Reconnaissance: Identify targets running RustDesk Client version 1.4.5 or earlier on any supported platform (Windows, macOS, Linux, iOS, Android). Enumerate exposed RustDesk relay/rendezvous infrastructure or identify network positions suitable for MiTM interception.
2. Infrastructure Setup: Stand up an attacker-controlled RustDesk relay and rendezvous server to receive redirected client connections.
3. MiTM Positioning: Position between the victim client and the legitimate RustDesk server using ARP spoofing, DNS poisoning, rogue Wi-Fi access point, or similar network-level interception technique. Exploit TLS fallback (danger_accept_invalid_certs) to intercept encrypted traffic.
4. Config Hijack via URI: Deliver a malicious rustdesk://config/<encoded-attacker-server-config> URI to the victim (e.g., via phishing link, malicious webpage, or injected into intercepted traffic). The importConfig() function in flutter/lib/common.dart processes this without authorization checks, silently re-homing the client to the attacker's server.
5. Password Overwrite: Send a rustdesk://password/<NEW_PWD> URI to overwrite the victim's RustDesk access password via FFI without privilege verification, enabling direct remote access.
6. Strategy API Abuse: Use the rogue server's Strategy API to override client security policies (e.g., disable access controls, enable unattended access).
7. Credential Exfiltration: Harvest plaintext credentials transmitted during heartbeat synchronization between the re-homed client and the attacker's server.
8. Persistent Remote Access: Use the overwritten password and re-homed configuration to establish persistent, unauthorized remote desktop access to the victim's machine (PoC Document, Feedly).

• Network: Outbound RustDesk relay/rendezvous connections to unexpected or unknown server IPs/domains; TLS handshake failures or certificate validation errors in RustDesk traffic; unusual heartbeat sync traffic to non-standard relay servers.
• Logs: RustDesk application logs showing importConfig() invocations from unexpected sources; URI scheme handler activations for rustdesk://config/ or rustdesk://password/ not initiated by the local user; configuration changes logged without corresponding user action.
• File System: Unexpected modifications to RustDesk configuration files (e.g., RustDesk2.toml or equivalent) reflecting new relay/rendezvous server addresses; timestamp anomalies on config files.
• Process Behavior: RustDesk client process initiating connections to previously unseen relay server addresses; unexpected password change events within the RustDesk service; RustDesk process spawning unusual child processes or making anomalous network calls (PoC Document, Feedly).

No official patch has been released for RustDesk Client as of the time of this report; users should monitor the RustDesk releases page for updates beyond version 1.4.5. As interim mitigations: restrict RustDesk URI scheme handler invocations at the OS or browser level where possible; enforce network-level protections (VPN, network segmentation) to prevent MiTM positioning; validate and verify configuration imports only from trusted, authenticated sources; disable or monitor rustdesk://config/ and rustdesk://password/ URI scheme handling; and monitor for suspicious URI scheme invocations and unexpected configuration changes (Feedly, ENISA EUVD).

The vulnerability received coverage from security aggregators and community platforms shortly after disclosure, including posts on Bluesky and coverage by INCIBE-CERT (Spain's national cybersecurity incident response team) (INCIBE-CERT). A technical blog post was published at infinitsec.net specifically analyzing the rustdesk://config/ URI silent re-homing attack chain (Infinitsec Blog). No official statement from the RustDesk development team has been publicly identified at this time.