# CVE-2026-30796: RustDesk Client plaintext credential disclosure in heartbeat sync

Source: https://junglewise.ai/threats/cve-2026-30796-rustdesk-client-plaintext-credential-disclosure-in-heartbeat-sync  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-05. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-30796 · Severity: high · CVSS 7.5 · Published 2026-03-05

RustDesk, a remote desktop application, contains a security flaw where it transmits address book passwords in an insecure format. If an attacker manages to intercept the connection or trick the software into connecting to a malicious server, they can capture these passwords. This allows the attacker to gain unauthorized access to the user's saved address book and the contact information within it.

Technologies: [Apple macOS](https://junglewise.ai/threats/technologies/macos), [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Microsoft Windows](https://junglewise.ai/threats/technologies/windows), [RustDesk Client](https://junglewise.ai/threats/technologies/rustdesk-client), [RustDesk Server Pro](https://junglewise.ai/threats/technologies/rustdesk-server-pro). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple), [Linux](https://junglewise.ai/threats/vendors/linux), [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [Rustdesk](https://junglewise.ai/threats/vendors/rustdesk).

## Quick answers

**Is CVE-2026-30796 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30796 being exploited in the wild.

**How severe is CVE-2026-30796?** High severity, with a CVSS score of 7.5, published 5 March 2026.

**Which products and versions are affected?** RustDesk Client through 1.4.8; RustDesk Server Pro through 1.7.5.

**Is there a fix for CVE-2026-30796?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-30796 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-30796?** Check whether you run Apple macOS, Linux Kernel, Microsoft Windows or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The RustDesk Client (specifically in src/hbbs_http/sync.rs) transmits the preset address-book password verbatim within the JSON body of heartbeat synchronization requests. While typically protected by HTTPS, the application is vulnerable to a TLS downgrade attack (CVE-2026-30794) or infrastructure hijacking (CVE-2026-30797) that allows a rogue API endpoint to recover the credential. Because the password is a reusable shared secret rather than a zero-knowledge proof (like SRP), an attacker who captures the plaintext can use it to authorize access to the server-side address book. This affects all native clients (Windows, MacOS, Linux, iOS, Android) through version 1.4.8.

## Affected products

- RustDesk RustDesk Client through 1.4.8
- RustDesk RustDesk Server Pro through 1.7.5

## Timeline

- 2026-03-05: disclosed: Initial vulnerability discovery and publication.
- 2026-06-22: advisory: Advisory updated with expanded version ranges and CWE-522.

## References

- [https://github.com/rustdesk/rustdesk/releases](https://github.com/rustdesk/rustdesk/releases)
- [https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub](https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub)
- [https://rustdesk.com/docs/en/](https://rustdesk.com/docs/en/)
- [https://www.vulsec.org/](https://www.vulsec.org/)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Windows BitLocker heap buffer overflow with physical attack](https://junglewise.ai/threats/cve-2026-97015-heap-based-buffer-overflow-in-windows-bitlocker-allows-an)
- [Microsoft Windows Shell type confusion privilege elevation](https://junglewise.ai/threats/cve-2026-97013-access-of-resource-using-incompatible-type-type-confusion-in)