Vulnerability · Published Jul 10, 2026 · Assigned by VulnCheck

CVE-2026-57850RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection

High 8.3

In plain English

A high-severity missing authorization in RustDesk from RustDesk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.5%top 57.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved for a full Remote session. An authenticated remote peer can exploit this missing scope check to act outside its granted scope, injecting out-of-scope control messages to observe and control the host beyond the permissions it was given.

Affected products (as reported)

Vendor	Product	Versions
RustDesk	RustDesk	0 – before 1.4.9

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

Fix Pull Request #15469 patch
Patch Commit patch
RustDesk 1.4.9 Release release-notes
Product product
https://www.vulncheck.com/advisories/rustdesk-missing-session-scope-enforcement-allows-out-of-scope-control-message-injection third-party-advisory
PoC technical-description