Is CVE-2026-57850 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57850 being exploited in the wild.

How severe is CVE-2026-57850?

High severity, with a CVSS score of 8.3, published 10 July 2026.

Is there a fix for CVE-2026-57850?

A patch was published on 2026-07-05: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57850 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-57850?

Check whether you run Rustdesk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57850: RustDesk missing authorization in session scope enforcement

CVE-2026-57850 · Severity: high · CVSS 8.3 · Published 2026-07-10

RustDesk is an open-source remote desktop application used for accessing and controlling computers over a network. A security flaw in versions prior to 1.4.9 allows users who were granted only limited access (such as just transferring files or viewing a camera) to bypass these restrictions and gain full control over the remote computer. This could lead to unauthorized access to sensitive data, system settings, and full remote takeover by an authenticated but restricted user.

Technologies: Rustdesk. Vendors: Rustdesk.

Quick answers

Is CVE-2026-57850 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57850 being exploited in the wild.
How severe is CVE-2026-57850?: High severity, with a CVSS score of 8.3, published 10 July 2026.
Which products and versions are affected?: Rustdesk < 1.4.9.
Is there a fix for CVE-2026-57850?: A patch was published on 2026-07-05: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57850 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-57850?: Check whether you run Rustdesk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check (CWE-862) in RustDesk's server-side session management allows a peer with a restricted session type (FileTransfer, PortForward, ViewCamera, or Terminal) to bypass intended access controls. Because the server does not validate that incoming control messages match the authorized session scope, an attacker can inject out-of-scope control messages and login options. This enables a restricted user to escalate their privileges to a full 'Remote' session, granting them unauthorized observation and control of the host. The vulnerability is addressed in version 1.4.9 by implementing a whitelist-based message validation gate and session-scoped login option filtering.

Affected products

RustDesk RustDesk < 1.4.9

Timeline

2026-06-30: other: Pull request for session scope enforcement submitted
2026-07-05: patched: Fix merged into master branch
2026-07-06: advisory: Release 1.4.9 published
2026-07-10: disclosed: CVE-2026-57850 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.