CVE-2026-73241: 
Wolfi vulnerability analysis and mitigation

CVE-2026-73241 is an authentication bypass vulnerability in FreeRDP's server-side RDSTLS (Remote Desktop Security Transport Layer Security) implementation, allowing a remote unauthenticated attacker to bypass credential checks entirely. The flaw exists in libfreerdp/core/rdstls.c and affects all FreeRDP versions prior to 3.30.0, including the released 3.x series (confirmed on tag 3.27.1 and master HEAD). It was discovered by Anthropic using AI-assisted security research and validated by Ada Logics, with the advisory published on July 26, 2026, and the CVE assigned on August 11, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, Red Hat).

The vulnerability (CWE-287: Improper Authentication) stems from two compounding defects in libfreerdp/core/rdstls.c. First, the rdpRdstls object is calloc-zeroed at initialization, meaning resultCode defaults to 0, which is exactly RDSTLS_RESULT_SUCCESS — a fail-open default. Second, the rdstls_recv() dispatcher routes inbound PDUs based solely on the attacker-supplied wire pduType without validating that the received PDU type matches what the protocol state machine expects at the current step. When the server is waiting for an RDSTLS_TYPE_AUTHREQ (the PDU carrying credentials), an attacker can instead send an RDSTLS_TYPE_CAPABILITIES PDU; this is routed to rdstls_process_capabilities(), which validates only constant fields and returns TRUE without ever setting resultCode. The server then sends an AUTHRSP with the still-zero resultCode (SUCCESS), and rdstls_server_authenticate() at line 1025 passes the gate — having never invoked the credential comparison function rdstls_process_authentication_request_with_password(). Exploitation requires the server to be configured with RdstlsSecurity = TRUE, which is a non-default but legitimate deployment setting (GitHub Advisory, Fix Commit).

A remote unauthenticated attacker can fully bypass RDSTLS authentication on any FreeRDP-based server or proxy with RdstlsSecurity enabled, gaining access to an RDP session without presenting any valid credentials — no password, RedirectionGuid, username, domain, or auto-reconnect cookie is ever checked. The primary impact is a high confidentiality risk, as the attacker gains unauthorized access to the remote desktop session and any data visible or accessible within it. Integrity impact is assessed as low (CVSS v4.0), and there is no direct availability impact; however, unauthorized session access could serve as a foothold for lateral movement within the target environment (GitHub Advisory, Red Hat).

A self-contained proof-of-concept (PoC) reproducer was included in the original security advisory, demonstrating the bypass via a Docker-based test harness that confirms the server accepts a credential-less Capabilities PDU as SUCCESS while correctly rejecting a wrong RedirectionGuid with ACCESS_DENIED. As of the time of disclosure, there is no evidence of active in-the-wild exploitation or weaponized exploit kits, and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog. No specific threat actor attribution has been reported. The attack requires no privileges, no user interaction, and is network-accessible, making it straightforward to exploit against any exposed FreeRDP server with RDSTLS enabled (GitHub Advisory, Red Hat).

1. Reconnaissance: Identify internet-facing or network-accessible FreeRDP-based RDP servers or proxies running versions prior to 3.30.0. Use tools like Shodan or Censys to locate RDP endpoints (TCP port 3389), then probe for RDSTLS support during the RDP negotiation phase.
2. Initiate RDP connection: Establish a TCP connection to the target on port 3389 and send an X.224 Connection Request PDU with requestedProtocols including PROTOCOL_RDSTLS (0x04) to negotiate RDSTLS.
3. Complete TLS handshake: Perform the TLS handshake (accepting any server certificate, including self-signed) to establish the encrypted channel required for RDSTLS.
4. Receive server Capabilities PDU: After TLS, the server sends an RDSTLS_TYPE_CAPABILITIES PDU. Parse and acknowledge it as part of the normal RDSTLS handshake.
5. Send malicious Capabilities PDU instead of AUTHREQ: At the step where the server expects an RDSTLS_TYPE_AUTHREQ PDU (carrying credentials), instead send a credential-less RDSTLS_TYPE_CAPABILITIES PDU (e.g., 8 bytes: 0100 0100 0100 0100 in little-endian). This is the core of the PDU-type confusion attack.
6. Receive SUCCESS response: The server's rdstls_recv() routes the Capabilities PDU to rdstls_process_capabilities(), which returns TRUE without setting resultCode. The server sends an AUTHRSP PDU with resultCode = 0x00000000 (RDSTLS_RESULT_SUCCESS), and rdstls_server_authenticate() returns authenticated.
7. Proceed to authenticated session: The connection advances to the MCS (Multipoint Communication Service) layer as an authenticated session, granting the attacker unauthorized remote desktop access (GitHub Advisory).

• Network: Unexpected or repeated RDP connections (TCP/3389) from unknown or untrusted IP addresses to FreeRDP-based servers; RDSTLS negotiation (PROTOCOL_RDSTLS = 0x04) observed in X.224 Connection Request PDUs from clients that do not subsequently send a valid RDSTLS_TYPE_AUTHREQ.
• Network: RDSTLS AUTHRSP PDUs with resultCode = 0x00000000 (SUCCESS) sent by the server to clients that sent a Capabilities PDU at the authentication step (8-byte PDU: 0100010001000100) rather than a credential-bearing AUTHREQ.
• Logs: FreeRDP server logs showing successful RDSTLS authentication completions (rdstls_server_authenticate returning success) without corresponding credential comparison log entries (absence of [rdstls_cmp_data] or [rdstls_cmp_str] log lines for the session).
• Logs: Absence of [ERROR][com.freerdp.core.rdstls] credential verification messages for sessions that nonetheless complete authentication — contrasting with the expected pattern where failed credentials produce explicit error log entries.
• Process: Unexpected RDP session activity (new desktop sessions, process spawning) on FreeRDP servers without corresponding valid user login events in the operating system authentication logs.

Upgrade FreeRDP to version 3.30.0 or later, which includes the fix in commit b05a951 that adds state validation to rdstls_recv() (rejecting any PDU other than RDSTLS_TYPE_AUTHREQ at the authentication step) and initializes resultCode to RDSTLS_RESULT_ACCESS_DENIED instead of the fail-open zero value (FreeRDP Release, Fix Commit). As an immediate workaround for systems that cannot be patched, disable RDSTLS by ensuring RdstlsSecurity = FALSE (the default setting), which prevents the vulnerable code path from being reached. Additionally, implement network-level access controls (firewall rules, VPN requirements) to restrict RDP connectivity to trusted clients only, reducing the attack surface regardless of patch status (GitHub Advisory).

The vulnerability was credited to Claude (Anthropic) and Ada Logics, with the advisory noting it was "found using AI and agents to study the security of open-source projects." The FreeRDP maintainer (akallabeth) released version 3.30.0 as a "security and bugfix release" with the note "Addresses a severe server side issue, update highly recommended," indicating the project treats this as a high-priority fix (FreeRDP Release). Red Hat tracked the issue via Bugzilla (Bug 2514349) with high priority and severity ratings (Red Hat Bugzilla). No significant broader media coverage or social media discussion has been observed at this time.