Suse CVE-2026-33145

Upgrade xrdp to version 0.10.6 or later immediately; this is the vendor-released patch that fixes the AlternateShell command injection. The upgrade can be performed via package managers (apt upgrade xrdp on Debian/Ubuntu systems) or by rebuilding from source from the official GitHub repository. For organizations unable to upgrade immediately, implement the following compensating controls: (1) disable the AllowAlternateShell feature by setting AllowAlternateShell=false in /etc/xrdp/xrdp.ini on all xrdp servers, then restart the xrdp service (sudo systemctl restart xrdp); this eliminates the attack surface but prevents users from specifying custom shells, potentially breaking workflows that rely on shell customization; (2) restrict RDP access at the firewall or network level to only trusted IP ranges or VPN subnets, reducing the exposed authentication surface; (3) enforce strong RDP authentication via Network Policy Server (NPS) or RADIUS where available, preventing credential-based attacks; (4) monitor xrdp logs for failed connection attempts or unusual session parameters, though log coverage for AlternateShell injection attempts may be limited. None of these workarounds fully mitigate the flaw if AllowAlternateShell remains enabled, so patch deployment is strongly preferred. Reference vendor advisory: https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rmvv-7633-fg7h