9.1
CRITICAL
CVSS 4.0
CVE-2026-30794
RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure
Overview
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Details
INFO
Published Date :
March 5, 2026, 4:16 p.m.
Last Modified :
June 22, 2026, 2:17 p.m.
Remotely Exploit :
Yes !
Source :
2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Impact
Affected Products
The following products are affected by CVE-2026-30794
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | CRITICAL | 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe | ||||
| CVSS 4.0 | CRITICAL | 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe |
Solution
Update RustDesk Client to a version that properly validates certificates.
- Update RustDesk Client to version 1.4.6 or later.
- Remove the danger_accept_invalid_certs(true) setting.
- Ensure TLS certificates are correctly validated.
- Configure HTTP API client securely.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-30794 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-30794 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Jun. 22, 2026
Action Type Old Value New Value Changed Description Improper Certificate Validation vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (HTTP API client, TLS transport modules) allows Adversary in the Middle (AiTM). This vulnerability is associated with program files src/hbbs_http/http_client.Rs and program routines TLS retry with danger_accept_invalid_certs(true). This issue affects RustDesk Client: through 1.4.8. Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Removed CVSS V4.0 VULSec Labs: AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Removed CVSS V3.1 NIST: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Removed CWE VULSec Labs: CWE-295 Removed CPE Configuration AND OR *cpe:2.3:a:rustdesk:rustdesk:*:*:*:*:webclient:*:*:* versions up to (including) 1.4.5 OR cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* cpe:2.3:o:google:android:-:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Removed Reference VULSec Labs: https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub Removed Reference VULSec Labs: https://github.com/rustdesk/rustdesk Removed Reference VULSec Labs: https://www.vulsec.org/ Removed Reference Type VULSec Labs: https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub Types: Exploit, Third Party Advisory Removed Reference Type VULSec Labs: https://github.com/rustdesk/rustdesk Types: Product Removed Reference Type VULSec Labs: https://www.vulsec.org/ Types: Not Applicable Removed Affected [{'repo': 'https://github.com/rustdesk/rustdesk,https://github.com/rustdesk/hbb_common', 'vendor': 'rustdesk-client', 'modules': ['HTTP API client', 'TLS transport'], 'product': 'RustDesk Client', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'custom', 'lessThanOrEqual': '1.4.8'}], 'platforms': ['Windows', 'MacOS', 'Linux', 'iOS', 'Android'], 'packageName': 'rustdesk-client', 'programFiles': ['src/hbbs_http/http_client.rs', 'src/common.rs'], 'collectionURL': 'https://github.com/rustdesk/rustdesk/releases', 'defaultStatus': 'affected', 'programRoutines': [{'name': 'post_request_() request-layer auto-downgrade (recurses with danger_accept_invalid_certs(true))'}, {'name': 'upsert_tls_cache() (caches accept-invalid decision per-URL)'}]}] -
CVE Rejected by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Jun. 22, 2026
Action Type Old Value New Value -
CVE Modified by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Jun. 22, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://github.com/rustdesk/rustdesk,https://github.com/rustdesk/hbb_common', 'vendor': 'rustdesk-client', 'modules': ['HTTP API client', 'TLS transport'], 'product': 'RustDesk Client', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'custom', 'lessThanOrEqual': '1.4.5'}], 'platforms': ['Windows', 'MacOS', 'Linux', 'iOS', 'Android'], 'packageName': 'rustdesk-client', 'programFiles': ['src/hbbs_http/http_client.rs'], 'collectionURL': 'https://github.com/rustdesk/rustdesk/releases', 'defaultStatus': 'affected', 'programRoutines': [{'name': 'TLS retry with danger_accept_invalid_certs(true)'}]}] [{'repo': 'https://github.com/rustdesk/rustdesk,https://github.com/rustdesk/hbb_common', 'vendor': 'rustdesk-client', 'modules': ['HTTP API client', 'TLS transport'], 'product': 'RustDesk Client', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'custom', 'lessThanOrEqual': '1.4.8'}], 'platforms': ['Windows', 'MacOS', 'Linux', 'iOS', 'Android'], 'packageName': 'rustdesk-client', 'programFiles': ['src/hbbs_http/http_client.rs', 'src/common.rs'], 'collectionURL': 'https://github.com/rustdesk/rustdesk/releases', 'defaultStatus': 'affected', 'programRoutines': [{'name': 'post_request_() request-layer auto-downgrade (recurses with danger_accept_invalid_certs(true))'}, {'name': 'upsert_tls_cache() (caches accept-invalid decision per-URL)'}]}] Changed Description Improper Certificate Validation vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (HTTP API client, TLS transport modules) allows Adversary in the Middle (AiTM). This vulnerability is associated with program files src/hbbs_http/http_client.Rs and program routines TLS retry with danger_accept_invalid_certs(true). This issue affects RustDesk Client: through 1.4.5. Improper Certificate Validation vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (HTTP API client, TLS transport modules) allows Adversary in the Middle (AiTM). This vulnerability is associated with program files src/hbbs_http/http_client.Rs and program routines TLS retry with danger_accept_invalid_certs(true). This issue affects RustDesk Client: through 1.4.8. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-30794', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-03-17T14:34:50.647644Z'} -
CVE Modified by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/rustdesk/rustdesk,https://github.com/rustdesk/hbb_common', 'vendor': 'rustdesk-client', 'modules': ['HTTP API client', 'TLS transport'], 'product': 'RustDesk Client', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'custom', 'lessThanOrEqual': '1.4.5'}], 'platforms': ['Windows', 'MacOS', 'Linux', 'iOS', 'Android'], 'packageName': 'rustdesk-client', 'programFiles': ['src/hbbs_http/http_client.rs'], 'collectionURL': 'https://github.com/rustdesk/rustdesk/releases', 'defaultStatus': 'affected', 'programRoutines': [{'name': 'TLS retry with danger_accept_invalid_certs(true)'}]}] -
Initial Analysis by [email protected]
Mar. 25, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Added CPE Configuration AND OR *cpe:2.3:a:rustdesk:rustdesk:*:*:*:*:webclient:*:*:* versions up to (including) 1.4.5 OR cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* cpe:2.3:o:google:android:-:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Added Reference Type VULSec Labs: https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub Types: Exploit, Third Party Advisory Added Reference Type VULSec Labs: https://github.com/rustdesk/rustdesk Types: Product Added Reference Type VULSec Labs: https://www.vulsec.org/ Types: Not Applicable -
CVE Modified by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Mar. 05, 2026
Action Type Old Value New Value Added Reference https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub Added Reference https://www.vulsec.org/ -
New CVE Received by 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
Mar. 05, 2026
Action Type Old Value New Value Added Description Improper Certificate Validation vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (HTTP API client, TLS transport modules) allows Adversary in the Middle (AiTM). This vulnerability is associated with program files src/hbbs_http/http_client.Rs and program routines TLS retry with danger_accept_invalid_certs(true). This issue affects RustDesk Client: through 1.4.5. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-295 Added Reference https://github.com/rustdesk/rustdesk
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.