Vulnerability-Lookup

CVE-2026-30784 (GCVE-0-2026-30784)

Vulnerability from cvelistv5 – Published: 2026-03-05 15:58 – Updated: 2026-03-06 10:29

Title

RustDesk hbbs/hbbr Servers Broker Connections Without Any Authorization Check

Summary

Missing Authorization, Missing Authentication for Critical Function vulnerability in rustdesk-server RustDesk Server rustdesk-server, rustdesk-server-pro on hbbs/hbbr on all server platforms (Rendezvous server (hbbs), relay server (hbbr) modules) allows Privilege Abuse. This vulnerability is associated with program files src/rendezvous_server.Rs, src/relay_server.Rs and program routines handle_punch_hole_request(), RegisterPeer handler, relay forwarding. This issue affects RustDesk Server: through 1.7.5, through 1.1.15.

Severity ?

8.8 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

CWE

CWE-862 - Missing Authorization
CWE-306 - Missing Authentication for Critical Function

Assigner

VULSec

References

URL

Tags

	https://rustdesk.com/docs/en/self-host/	technical-descriptionproduct
	https://docs.google.com/document/d/e/2PACX-1vSds6…	third-party-advisoryexploit
	https://www.vulsec.org/	vdb-entrythird-party-advisory

Impacted products

	Vendor	Product	Version
	rustdesk-server	RustDesk Server	Affected: 0 , ≤ 1.7.5 (custom) Affected: 0 , ≤ 1.1.15 (custom)

Date Public ?

2026-03-05 13:45

Credits

Erez Kalman Erez Kalman

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30784",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-06T10:28:27.311766Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-06T10:29:25.085Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/rustdesk/",
          "defaultStatus": "affected",
          "modules": [
            "Rendezvous server (hbbs)",
            "relay server (hbbr)"
          ],
          "packageName": "rustdesk-server, rustdesk-server-pro",
          "platforms": [
            "hbbs/hbbr on all server platforms"
          ],
          "product": "RustDesk Server",
          "programFiles": [
            "src/rendezvous_server.rs",
            "src/relay_server.rs"
          ],
          "programRoutines": [
            {
              "name": "handle_punch_hole_request()"
            },
            {
              "name": "RegisterPeer handler"
            },
            {
              "name": "relay forwarding"
            }
          ],
          "repo": "https://github.com/rustdesk/rustdesk-server",
          "vendor": "rustdesk-server",
          "versions": [
            {
              "changes": [
                {
                  "at": "Server Pro",
                  "status": "affected"
                }
              ],
              "lessThanOrEqual": "1.7.5",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "Server OSS",
                  "status": "affected"
                }
              ],
              "lessThanOrEqual": "1.1.15",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Default \u2014 any hbbs/hbbr deployment (OSS or Pro)"
            }
          ],
          "value": "Default \u2014 any hbbs/hbbr deployment (OSS or Pro)"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Erez Kalman"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Erez Kalman"
        }
      ],
      "datePublic": "2026-03-05T13:45:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization, Missing Authentication for Critical Function vulnerability in rustdesk-server RustDesk Server rustdesk-server, rustdesk-server-pro on hbbs/hbbr on all server platforms (Rendezvous server (hbbs), relay server (hbbr) modules) allows Privilege Abuse.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003esrc/rendezvous_server.Rs\u003c/tt\u003e, \u003ctt\u003esrc/relay_server.Rs\u003c/tt\u003e and program routines \u003ctt\u003ehandle_punch_hole_request()\u003c/tt\u003e, \u003ctt\u003eRegisterPeer handler\u003c/tt\u003e, \u003ctt\u003erelay forwarding\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects RustDesk Server: through 1.7.5, through 1.1.15.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization, Missing Authentication for Critical Function vulnerability in rustdesk-server RustDesk Server rustdesk-server, rustdesk-server-pro on hbbs/hbbr on all server platforms (Rendezvous server (hbbs), relay server (hbbr) modules) allows Privilege Abuse. This vulnerability is associated with program files src/rendezvous_server.Rs, src/relay_server.Rs and program routines handle_punch_hole_request(), RegisterPeer handler, relay forwarding.\n\nThis issue affects RustDesk Server: through 1.7.5, through 1.1.15."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "PoC available.\u003cbr\u003e"
            }
          ],
          "value": "PoC available."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122 Privilege Abuse"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306 Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-05T17:03:15.491Z",
        "orgId": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
        "shortName": "VULSec"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "product"
          ],
          "url": "https://rustdesk.com/docs/en/self-host/"
        },
        {
          "tags": [
            "third-party-advisory",
            "exploit"
          ],
          "url": "https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub"
        },
        {
          "tags": [
            "vdb-entry",
            "third-party-advisory"
          ],
          "url": "https://www.vulsec.org/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Implement Signed Session Authorization Tokens validated by hbbs and hbbr"
            }
          ],
          "value": "Implement Signed Session Authorization Tokens validated by hbbs and hbbr"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "RustDesk hbbs/hbbr Servers Broker Connections Without Any Authorization Check",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Restrict network access to hbbs/hbbr ports (21116, 21117) via firewall. Use strong passwords."
            }
          ],
          "value": "Restrict network access to hbbs/hbbr ports (21116, 21117) via firewall. Use strong passwords."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
    "assignerShortName": "VULSec",
    "cveId": "CVE-2026-30784",
    "datePublished": "2026-03-05T15:58:46.790Z",
    "dateReserved": "2026-03-05T14:13:35.407Z",
    "dateUpdated": "2026-03-06T10:29:25.085Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-30784\",\"sourceIdentifier\":\"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\",\"published\":\"2026-03-05T16:16:19.110\",\"lastModified\":\"2026-03-05T19:38:33.877\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Missing Authorization, Missing Authentication for Critical Function vulnerability in rustdesk-server RustDesk Server rustdesk-server, rustdesk-server-pro on hbbs/hbbr on all server platforms (Rendezvous server (hbbs), relay server (hbbr) modules) allows Privilege Abuse. This vulnerability is associated with program files src/rendezvous_server.Rs, src/relay_server.Rs and program routines handle_punch_hole_request(), RegisterPeer handler, relay forwarding.\\n\\nThis issue affects RustDesk Server: through 1.7.5, through 1.1.15.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"},{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub\",\"source\":\"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\"},{\"url\":\"https://rustdesk.com/docs/en/self-host/\",\"source\":\"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\"},{\"url\":\"https://www.vulsec.org/\",\"source\":\"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-30784\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-06T10:28:27.311766Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-06T10:29:20.294Z\"}}], \"cna\": {\"title\": \"RustDesk hbbs/hbbr Servers Broker Connections Without Any Authorization Check\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Erez Kalman\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Erez Kalman\"}], \"impacts\": [{\"capecId\": \"CAPEC-122\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-122 Privilege Abuse\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.8, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/rustdesk/rustdesk-server\", \"vendor\": \"rustdesk-server\", \"modules\": [\"Rendezvous server (hbbs)\", \"relay server (hbbr)\"], \"product\": \"RustDesk Server\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"Server Pro\", \"status\": \"affected\"}], \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.7.5\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"Server OSS\", \"status\": \"affected\"}], \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.1.15\"}], \"platforms\": [\"hbbs/hbbr on all server platforms\"], \"packageName\": \"rustdesk-server, rustdesk-server-pro\", \"programFiles\": [\"src/rendezvous_server.rs\", \"src/relay_server.rs\"], \"collectionURL\": \"https://github.com/rustdesk/\", \"defaultStatus\": \"affected\", \"programRoutines\": [{\"name\": \"handle_punch_hole_request()\"}, {\"name\": \"RegisterPeer handler\"}, {\"name\": \"relay forwarding\"}]}], \"exploits\": [{\"lang\": \"en\", \"value\": \"PoC available.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"PoC available.\u003cbr\u003e\", \"base64\": false}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Implement Signed Session Authorization Tokens validated by hbbs and hbbr\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Implement Signed Session Authorization Tokens validated by hbbs and hbbr\", \"base64\": false}]}], \"datePublic\": \"2026-03-05T13:45:00.000Z\", \"references\": [{\"url\": \"https://rustdesk.com/docs/en/self-host/\", \"tags\": [\"technical-description\", \"product\"]}, {\"url\": \"https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub\", \"tags\": [\"third-party-advisory\", \"exploit\"]}, {\"url\": \"https://www.vulsec.org/\", \"tags\": [\"vdb-entry\", \"third-party-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Restrict network access to hbbs/hbbr ports (21116, 21117) via firewall. Use strong passwords.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Restrict network access to hbbs/hbbr ports (21116, 21117) via firewall. Use strong passwords.\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Missing Authorization, Missing Authentication for Critical Function vulnerability in rustdesk-server RustDesk Server rustdesk-server, rustdesk-server-pro on hbbs/hbbr on all server platforms (Rendezvous server (hbbs), relay server (hbbr) modules) allows Privilege Abuse. This vulnerability is associated with program files src/rendezvous_server.Rs, src/relay_server.Rs and program routines handle_punch_hole_request(), RegisterPeer handler, relay forwarding.\\n\\nThis issue affects RustDesk Server: through 1.7.5, through 1.1.15.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Missing Authorization, Missing Authentication for Critical Function vulnerability in rustdesk-server RustDesk Server rustdesk-server, rustdesk-server-pro on hbbs/hbbr on all server platforms (Rendezvous server (hbbs), relay server (hbbr) modules) allows Privilege Abuse.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003esrc/rendezvous_server.Rs\u003c/tt\u003e, \u003ctt\u003esrc/relay_server.Rs\u003c/tt\u003e and program routines \u003ctt\u003ehandle_punch_hole_request()\u003c/tt\u003e, \u003ctt\u003eRegisterPeer handler\u003c/tt\u003e, \u003ctt\u003erelay forwarding\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects RustDesk Server: through 1.7.5, through 1.1.15.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"CWE-306 Missing Authentication for Critical Function\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Default \\u2014 any hbbs/hbbr deployment (OSS or Pro)\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Default \\u2014 any hbbs/hbbr deployment (OSS or Pro)\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\", \"shortName\": \"VULSec\", \"dateUpdated\": \"2026-03-05T17:03:15.491Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-30784\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-06T10:29:25.085Z\", \"dateReserved\": \"2026-03-05T14:13:35.407Z\", \"assignerOrgId\": \"2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe\", \"datePublished\": \"2026-03-05T15:58:46.790Z\", \"assignerShortName\": \"VULSec\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-30784

Vulnerability from fkie_nvd - Published: 2026-03-05 16:16 - Updated: 2026-03-05 19:38

Severity ?

8.8 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe	https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub
	2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe	https://rustdesk.com/docs/en/self-host/
	2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe	https://www.vulsec.org/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authorization, Missing Authentication for Critical Function vulnerability in rustdesk-server RustDesk Server rustdesk-server, rustdesk-server-pro on hbbs/hbbr on all server platforms (Rendezvous server (hbbs), relay server (hbbr) modules) allows Privilege Abuse. This vulnerability is associated with program files src/rendezvous_server.Rs, src/relay_server.Rs and program routines handle_punch_hole_request(), RegisterPeer handler, relay forwarding.\n\nThis issue affects RustDesk Server: through 1.7.5, through 1.1.15."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Autorizaci\u00f3n Faltante, Autenticaci\u00f3n Faltante para Funci\u00f3n Cr\u00edtica en rustdesk-server RustDesk Server rustdesk-server, rustdesk-server-pro en hbbs/hbbr en todas las plataformas de servidor (m\u00f3dulos de servidor Rendezvous (hbbs), servidor de retransmisi\u00f3n (hbbr)) permite el Abuso de Privilegios. Esta vulnerabilidad est\u00e1 asociada con los archivos de programa src/rendezvous_server.Rs, src/relay_server.Rs y las rutinas de programa handle_punch_hole_request(), el gestor RegisterPeer, el reenv\u00edo de retransmisi\u00f3n.\n\nEste problema afecta a RustDesk Server: hasta 1.7.5, hasta 1.1.15."
    }
  ],
  "id": "CVE-2026-30784",
  "lastModified": "2026-03-05T19:38:33.877",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-05T16:16:19.110",
  "references": [
    {
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
      "url": "https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub"
    },
    {
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
      "url": "https://rustdesk.com/docs/en/self-host/"
    },
    {
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
      "url": "https://www.vulsec.org/"
    }
  ],
  "sourceIdentifier": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
      "type": "Secondary"
    }
  ]
}

GHSA-52MV-RF68-XH44

Vulnerability from github – Published: 2026-03-05 18:31 – Updated: 2026-03-05 21:30

Details

This issue affects RustDesk Server: through 1.7.5, through 1.1.15.

Severity ?

8.8 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-30784"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-05T16:16:19Z",
    "severity": "HIGH"
  },
  "details": "Missing Authorization, Missing Authentication for Critical Function vulnerability in rustdesk-server RustDesk Server rustdesk-server, rustdesk-server-pro on hbbs/hbbr on all server platforms (Rendezvous server (hbbs), relay server (hbbr) modules) allows Privilege Abuse. This vulnerability is associated with program files src/rendezvous_server.Rs, src/relay_server.Rs and program routines handle_punch_hole_request(), RegisterPeer handler, relay forwarding.\n\nThis issue affects RustDesk Server: through 1.7.5, through 1.1.15.",
  "id": "GHSA-52mv-rf68-xh44",
  "modified": "2026-03-05T21:30:45Z",
  "published": "2026-03-05T18:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30784"
    },
    {
      "type": "WEB",
      "url": "https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub"
    },
    {
      "type": "WEB",
      "url": "https://rustdesk.com/docs/en/self-host"
    },
    {
      "type": "WEB",
      "url": "https://www.vulsec.org"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-30784 (GCVE-0-2026-30784)

FKIE_CVE-2026-30784

GHSA-52MV-RF68-XH44

Tags

Sightings

Nomenclature