# CVE-2026-30783: RustDesk Client privilege abuse via unauthenticated strategy injection

Source: https://junglewise.ai/threats/cve-2026-30783-rustdesk-client-privilege-abuse-via-unauthenticated-strategy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-05. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-30783 · Severity: critical · CVSS 9.8 · Published 2026-03-05

RustDesk is a remote desktop application used to access and control computers over a network. A critical vulnerability allows attackers to bypass security settings and gain unauthorized control over a device. This could lead to complete system takeover, theft of sensitive data, or disruption of business operations across Windows, macOS, Linux, and mobile platforms.

Technologies: [Apple Iphone Os](https://junglewise.ai/threats/technologies/iphone-os), [Apple macOS](https://junglewise.ai/threats/technologies/macos), [Google Android](https://junglewise.ai/threats/technologies/android), [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Microsoft Windows](https://junglewise.ai/threats/technologies/windows), [Rustdesk](https://junglewise.ai/threats/technologies/rustdesk), [RustDesk Client](https://junglewise.ai/threats/technologies/rustdesk-client). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple), [Google](https://junglewise.ai/threats/vendors/google), [Linux](https://junglewise.ai/threats/vendors/linux), [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [Rustdesk](https://junglewise.ai/threats/vendors/rustdesk).

## Quick answers

**Is CVE-2026-30783 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30783 being exploited in the wild.

**How severe is CVE-2026-30783?** Critical severity, with a CVSS score of 9.8, published 5 March 2026.

**Which products and versions are affected?** RustDesk Client through 1.4.8.

**Is there a fix for CVE-2026-30783?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-30783 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-30783?** Check whether you run Apple Iphone Os, Apple macOS, Google Android or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the RustDesk Client (specifically within the API sync loop and strategy management modules) allows for unauthenticated remote strategy injection. The root cause is located in 'src/hbbs_http/sync.rs' and 'hbb_common/src/config.rs', where the client blindly merges strategy configurations from a server without verifying the local 'allow-remote-config-modification' toggle. An attacker operating a rogue API server or performing a Man-in-the-Middle (MiTM) attack can override local security policies, clear IP whitelists, escalate access modes from view-only to full-control, and re-enable disabled features like file transfer or terminal access. This issue affects all native Flutter-based clients through version 1.4.8.

## Affected products

- RustDesk RustDesk Client through 1.4.8

## Timeline

- 2026-03-05: disclosed: Initial vulnerability discovery and publication
- 2026-06-22: advisory: Updated advisory confirming impact through version 1.4.8

## References

- [https://github.com/rustdesk/rustdesk/releases](https://github.com/rustdesk/rustdesk/releases)
- [https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub](https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub)
- [https://rustdesk.com/docs/en/client/](https://rustdesk.com/docs/en/client/)
- [https://www.vulsec.org/](https://www.vulsec.org/)

## Related threats

- [Google Android Bluetooth buffer overflow in acquireMemory](https://junglewise.ai/threats/cve-2026-95405-in-acquirememory-of-bt-bqr-offload-cc-there-is-a-possible-way-to)
- [ST NFC HAL out-of-bounds write in global memory](https://junglewise.ai/threats/cve-2026-95400-in-stnfc-hal-write-of-hal-st21nfc-cc-there-is-a-possible-way-to)
- [Android HEVC decoder buffer overflow in sub_layer_hrd_parameters](https://junglewise.ai/threats/cve-2026-95397-in-sub-layer-hrd-parameters-of-hevc-decoder-there-is-a-possible)
- [Android framework memory exhaustion in message queue handling](https://junglewise.ai/threats/cve-2026-59632-in-respondreceivedmessage-of-mtsmessagecontroller-cpp-there-is-a)
- [Android use-after-free in UssiController connection listener](https://junglewise.ai/threats/cve-2026-59626-in-sendinfo-of-ussicontroller-cpp-there-is-a-possible-way-to)