PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-30796 rustdesk-client CVE debrief

CVE-2026-30796 is a Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials vulnerability in RustDesk Client on multiple platforms. The vulnerability allows for Sniffing Attacks due to the transmission of the preset address-book password in cleartext within the heartbeat sync JSON body. This issue affects RustDesk Client versions up to 1.4.8 and is associated with program files src/hbbs_http/sync.rs. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity.

Vendor
rustdesk-client
Product
Unknown
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-05
Original CVE updated
2026-07-19
Advisory published
2026-03-05
Advisory updated
2026-07-19

Who should care

Defenders of RustDesk Client installations, particularly those using versions up to 1.4.8 on Windows, MacOS, Linux, iOS, and Android, should be aware of this vulnerability. The exposure of the address-book password in cleartext during synchronization could lead to unauthorized access to the address book if an attacker can intercept or manipulate the heartbeat sync data.

Technical summary

The RustDesk Client vulnerability (CVE-2026-30796) involves the insecure transmission of sensitive information, specifically the preset address-book password. This password is included verbatim in the heartbeat sync JSON body (src/hbbs_http/sync.rs). Although transmitted over an intact HTTPS session, the reuse of this shared secret allows any party becoming the API endpoint to recover the credential. This could happen through an automatic invalid-certificate TLS downgrade (CVE-2026-30794) or a re-homed/rogue API server (CVE-2026-30797), leading to unauthorized access to the server-side address book.

Defensive priority

Medium priority due to the potential for credential exposure and address book access.

Recommended defensive actions

  • Inventory and update RustDesk Client to the latest version beyond 1.4.8.
  • Review and restrict access to the RustDesk Client API endpoints.
  • Implement additional monitoring for suspicious heartbeat sync activities.
  • Enforce secure TLS configurations and certificate validation.
  • Consider using zero-knowledge proof authentication mechanisms if available.

Evidence notes

The primary evidence for this vulnerability comes from the CVE-2026-30796 record and associated sources. The affected product is RustDesk Client, up to version 1.4.8, across various platforms. Defenders should verify the version of RustDesk Client in use and review the official documentation for mitigation strategies.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-30796 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-30796

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-30796 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-30796

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub

    2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe - Exploit, Third Party Advisory

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://rustdesk.com/docs/en/

    2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe - Product, Vendor Advisory

  • Source reference

    Unverified legacy reference

    URL: https://www.vulsec.org/

    2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe - Not Applicable

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.