Executive brief
RustDesk is an open-source remote desktop application used for accessing and controlling computers over a network. A security flaw in versions prior to 1.4.9 allows users who were granted only limited access (such as just transferring files or viewing a camera) to bypass these restrictions and gain full control over the remote computer. This could lead to unauthorized access to sensitive data, system settings, and full remote takeover by an authenticated but restricted user.
Technical details
A missing authorization check (CWE-862) in RustDesk's server-side session management allows a peer with a restricted session type (FileTransfer, PortForward, ViewCamera, or Terminal) to bypass intended access controls. Because the server does not validate that incoming control messages match the authorized session scope, an attacker can inject out-of-scope control messages and login options. This enables a restricted user to escalate their privileges to a full 'Remote' session, granting them unauthorized observation and control of the host. The vulnerability is addressed in version 1.4.9 by implementing a whitelist-based message validation gate and session-scoped login option filtering.
Affected products
- RustDesk RustDesk < 1.4.9
Timeline
- 2026-06-30: other: Pull request for session scope enforcement submitted
- 2026-07-05: patched: Fix merged into master branch
- 2026-07-06: advisory: Release 1.4.9 published
- 2026-07-10: disclosed: CVE-2026-57850 published