CVE-2026-30796
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability in the RustDesk client transmits the address book password in cleartext within the heartbeat sync JSON body. Although HTTPS encrypts the transmission, the password is a shared secret that can be recovered by an attacker who compromises the API server.
Risk Assessment
The organization risks exposure of the address book password, enabling attackers to access sensitive contact data and potentially hijack remote sessions.
Recommendation
Immediately upgrade the RustDesk client to a version later than 1.4.8 and implement zero-knowledge proof for address book authentication.
Other vulnerabilities in RustDesk Client
See all- CVE-2026-30789Critical
A vulnerability in the RustDesk client allows for password brute forcing due to insufficient computational effort in hashing and improper restriction of excessive authentication attempts. The authentication mechanism based on SHA256 does not use a slow key-derivation function, enabling attackers to recover passwords offline.
- CVE-2026-30792High
A vulnerability in the RustDesk Client allows Application API Message Manipulation via Man-in-the-Middle. This affects various platforms including Windows, MacOS, Linux, iOS, Android, and WebClient.
Original NVD description (English source)
Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks. The client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book. This vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password). This issue affects RustDesk Client: through 1.4.8.