Vulnerability · Published Jun 28, 2026 · Assigned by VulnCheck

CVE-2026-58056RustDesk - FileTransfer Session Authorization Scope Bypass

High 7.6

In plain English

A high-severity incorrect authorization in RustDesk from RustDesk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.3%top 74.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.

Affected products (as reported)

Vendor	Product	Versions
RustDesk	RustDesk	0 – through 1.4.8

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

Proof of Concept exploit, third-party-advisory
VulnCheck Advisory: RustDesk - FileTransfer Session Authorization Scope Bypass third-party-advisory