# CVE-2026-30790: RustDesk Client and Server weak password hashing and credential exposure

Source: https://junglewise.ai/threats/cve-2026-30790-rustdesk-client-and-server-weak-password-hashing-and-credential  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-05. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-30790 · Severity: critical · CVSS 9.8 · Published 2026-03-05

A vulnerability in the RustDesk remote desktop client and server allows attackers to intercept and crack user passwords. When connecting to a Pro server, the software transmits login proofs using weak encryption that can be easily broken if the connection is intercepted. This could allow an unauthorized person to gain full remote access to managed computers, potentially leading to data theft or complete system takeover.

Technologies: [RustDesk Client](https://junglewise.ai/threats/technologies/rustdesk-client), [RustDesk Server Pro](https://junglewise.ai/threats/technologies/rustdesk-server-pro). Vendors: [Rustdesk](https://junglewise.ai/threats/vendors/rustdesk).

## Quick answers

**Is CVE-2026-30790 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30790 being exploited in the wild.

**How severe is CVE-2026-30790?** Critical severity, with a CVSS score of 9.8, published 5 March 2026.

**Which products and versions are affected?** RustDesk Client through 1.4.8; RustDesk Server OSS through 1.1.15; RustDesk Server Pro through 1.7.5.

**Is there a fix for CVE-2026-30790?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-30790 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-30790?** Check whether you run RustDesk Client, RustDesk Server OSS or RustDesk Server Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The RustDesk Client (through 1.4.8) and Server (Pro through 1.7.5, OSS through 1.1.15) utilize an insecure authentication handshake for API logins. The login proof is constructed using a fast double SHA256 hash over a server-provided salt and challenge, lacking a slow Key Derivation Function (KDF) like Argon2 or bcrypt, which makes it susceptible to offline brute-force attacks. Furthermore, while the peer-to-peer channel is secured, the API login path relies solely on TLS; combined with a separate vulnerability (CVE-2026-30794) that allows automatic downgrades to invalid certificates, an attacker can perform a Man-in-the-Middle (MitM) attack to capture the weak hashes. Successful exploitation allows an attacker to recover the plaintext password and authenticate as the user.

## Affected products

- RustDesk RustDesk Client through 1.4.8
- RustDesk RustDesk Server Pro through 1.7.5
- RustDesk RustDesk Server (OSS) through 1.1.15

## Timeline

- 2026-03-05: disclosed: Initial discovery and publication of findings by VULSec Labs.
- 2026-03-05: advisory: CVE-2026-30790 assigned and published.
- 2026-06-22: other: Advisory updated with expanded technical details and affected version ranges.

## References

- [https://github.com/rustdesk/rustdesk-server-pro/releases](https://github.com/rustdesk/rustdesk-server-pro/releases)
- [https://github.com/rustdesk/rustdesk-server/releases](https://github.com/rustdesk/rustdesk-server/releases)
- [https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub](https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub)
- [https://github.com/rustdesk](https://github.com/rustdesk)
- [https://www.vulsec.org/](https://www.vulsec.org/)

## Related threats

- [RustDesk Client Remote Denial of Service in Heartbeat Loop](https://junglewise.ai/threats/cve-2026-30798-rustdesk-client-remote-denial-of-service-in-heartbeat-loop)
- [RustDesk Client plaintext credential disclosure in heartbeat sync](https://junglewise.ai/threats/cve-2026-30796-rustdesk-client-plaintext-credential-disclosure-in-heartbeat-sync)
- [RustDesk Client improper certificate validation in TLS transport modules](https://junglewise.ai/threats/cve-2026-30794-rustdesk-client-improper-certificate-validation-in-tls-transport)
- [RustDesk Client Remote Strategy Injection via Man-in-the-Middle](https://junglewise.ai/threats/cve-2026-30792-rustdesk-client-remote-strategy-injection-via-man-in-the-middle)
- [RustDesk Client authentication bypass via session replay and weak hashing](https://junglewise.ai/threats/cve-2026-30789-rustdesk-client-authentication-bypass-via-session-replay-and-weak)