RustDesk hbbs/hbbr Servers établit des connexions Broker sans aucune vérification d'autorisation

The core of this vulnerability lies in the inadequate authorization and authentication checks within the RustDesk Server's Rendezvous and relay server modules. Attackers can exploit this to bypass security controls and gain elevated privileges. Successful exploitation could lead to unauthorized access to sensitive data, modification of server configurations, and even complete control over the server infrastructure. The handlepunchhole_request() and RegisterPeer handlers, as well as relay forwarding routines, are particularly vulnerable. The potential impact is significant, especially considering RustDesk's use in remote access scenarios, where compromised servers could expose user data and systems to malicious actors.

Organizations and individuals relying on RustDesk Server for remote access are at risk. This includes businesses using RustDesk for remote support, education institutions utilizing it for online learning, and individuals using it for personal remote access. Shared hosting environments where multiple users share a single RustDesk Server instance are particularly vulnerable, as a compromise of the server could affect all users.

• rust: Examine RustDesk Server logs for unusual connection attempts or authentication failures, particularly targeting the handlepunchhole_request() and RegisterPeer endpoints. • linux / server: Use journalctl -u rustdesk-server to monitor for errors or suspicious activity related to authentication and authorization. • generic web: Monitor access logs for requests to the Rendezvous and relay server endpoints originating from unexpected IP addresses or user agents.

1. 2026-03-05Disclosure

   disclosure

1. Réservé2026-03-05
2. Publiée2026-03-05
3. Modifiée2026-03-06
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2026-30784 is to upgrade to a patched version of RustDesk Server as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds to reduce the attack surface. These may include restricting network access to the server, implementing stricter firewall rules to limit inbound connections, and carefully reviewing and auditing server configurations. Monitoring logs for suspicious activity related to the handlepunchhole_request() and RegisterPeer handlers is also recommended. After upgrading, verify the fix by attempting to connect to the server using unauthorized credentials and confirming that access is denied.