RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation

The CSRF vulnerability in RustDesk Client allows an attacker to trick a legitimate user into unknowingly executing malicious actions within the application. Specifically, an attacker could leverage this flaw to modify the user's permanent password via the rustdesk://password/ URI handler, effectively gaining unauthorized access to the user's RustDesk session. The attack surface spans multiple platforms including Windows, MacOS, Linux, iOS, and Android, increasing the potential blast radius. Successful exploitation could lead to data breaches, unauthorized remote access, and potential compromise of systems connected to the RustDesk service. While no direct precedent exists for this specific vulnerability, CSRF vulnerabilities generally pose a significant risk due to their ease of exploitation and potential for widespread impact.

Users who rely on RustDesk Client for remote access, particularly those who frequently use the application on public or shared networks, are at increased risk. Individuals who have not enabled strong password policies or are prone to clicking on suspicious links are also more vulnerable.

• flutter / mobile: Inspect network traffic for suspicious requests to rustdesk://password/ from unexpected origins. Use mobile device monitoring tools to detect unauthorized application activity. • generic web: Monitor access logs for requests containing the rustdesk://password/ URI scheme. Look for unusual user agent strings or referrer headers. • generic web: Implement a WAF rule to block requests containing the rustdesk://password/ URI scheme from untrusted origins.

1. 2026-03-05Disclosure

   disclosure

1. Reserviert2026-03-05
2. Veröffentlicht2026-03-05
3. Geändert2026-03-17
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-30793 is to upgrade to a patched version of RustDesk Client. The vendor has not released a specific fixed version as of this writing, but monitor their official channels for updates. As a temporary workaround, consider implementing strict Content Security Policy (CSP) headers to restrict the origins from which RustDesk Client can load resources. Additionally, educate users about the risks of clicking on suspicious links and entering credentials on untrusted websites. After upgrading, verify the fix by attempting to trigger the password modification URI handler from a different origin and confirming that the request is blocked.