CVE-2026-30796 Details
Description
Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks. The client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book. This vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password). This issue affects RustDesk Client: through 1.4.8.
A vulnerability in RustDesk Server Pro in versions through 1.7.5 allows for sniffing attacks due to the cleartext transmission of sensitive information. This issue arises in the address book sync API modules across Windows, macOS, and Linux. The vulnerability is linked to the heartbeat API handler, which accepts preset address book passwords in plaintext.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub | VULSec Labs | ExploitThird Party Advisory |
| https://rustdesk.com/docs/en/ | VULSec Labs | ProductVendor Advisory |
| https://www.vulsec.org/ | VULSec Labs | Not Applicable |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | VULSec Labs |
Affected Products
| Product | Versions |
|---|---|
| rustdesk rustdesk server | <= 1.7.5 |
CPE
Remediation
| |
| apple macos | All versions |
CPE
Remediation
| |
| linux linux kernel | All versions |
CPE
Remediation
| |
| microsoft windows | All versions |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 19, 2026 | CVE Modified | VULSec Labs |
| Jun 22, 2026 | CVE Modified | VULSec Labs |
| Jun 22, 2026 | CVE Modified | VULSec Labs |
| Jun 17, 2026 | CVE Modified | VULSec Labs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | Reanalysis | [email protected] |
| Mar 25, 2026 | Reanalysis | [email protected] |
| Mar 25, 2026 | Initial Analysis | [email protected] |
| Mar 5, 2026 | CVE Modified | VULSec Labs |
| Mar 5, 2026 | New CVE Received | VULSec Labs |