Which versions of RustDesk are affected by CVE-2026-57850?

RustDesk versions before 1.4.9 contain an unpatched privilege escalation vulnerability allowing authenticated users with restricted remote access permissions to escalate to full remote control.. A patch is available.

How to fix or mitigate CVE-2026-57850?

24 hours: Identify all RustDesk deployments and affected versions; disable RustDesk for sensitive systems if versions before 1.4.9 are in use; assess risk from users with limited-scope access permissions. 7 days: Implement network segmentation to restrict RustDesk access to trusted networks; deploy alternative remote access solutions (SSH with MFA, commercial RDP, jump hosts) for critical systems; monitor for 1.4.9 release announcement. 30 days: Upgrade all RustDesk instances to 1.4.9 or later when available; audit remote session logs for unauthorized escalation; implement continuous monitoring for anomalies; complete migration to alternative solutions if upgrade is delayed.

RustDesk CVE-2026-57850

Q: What is the CVSS score of CVE-2026-57850?

CVE-2026-57850 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43008 HIGH

Missing Authorization (CWE-862)

2026-07-10 disclosure@vulncheck.com

GHSA-83jc-7j6x-wvj9

Authentication Bypass

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable escalation by an already-authenticated limited-session peer (PR:L), no user interaction, yielding full screen/control (C:H/I:H) with minor availability effect (A:L); scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 21:02 EUVD

Analysis Generated

Jul 10, 2026 - 20:34 vuln.today

DescriptionCVE.org

RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved for a full Remote session. An authenticated remote peer can exploit this missing scope check to act outside its granted scope, injecting out-of-scope control messages to observe and control the host beyond the permissions it was given.

AnalysisAI

Privilege escalation within RustDesk before 1.4.9 lets an authenticated peer that was granted only a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) send control messages and login options reserved for a full Remote session, because the server never re-validates a session's authorized scope. The result is that a peer given, for example, file-transfer-only access can observe and control the host's screen and input as if it held full remote-control rights. No public exploit has been identified at time of analysis, though the fixing pull request and commit are public, and no EPSS or CISA KEV data was supplied.

Technical ContextAI

RustDesk is an open-source remote-desktop/remote-access platform (Rust client and self-hostable relay/rendezvous servers) whose protocol distinguishes several session types - full Remote control versus narrower modes such as FileTransfer, PortForward, ViewCamera, and Terminal. The flaw is CWE-862 (Missing Authorization): the session type is agreed at connection setup but the server side does not enforce that subsequent control messages and login options fall within the session's granted scope. Because authorization is effectively checked only at grant time and not per message, out-of-scope control/login-option messages are honored, letting a narrow session behave as a full Remote session. The upstream fix (PR #15469, commit 493b14b, released in 1.4.9) adds the missing server-side scope enforcement.

RemediationAI

Upgrade to RustDesk 1.4.9 or later, which adds the missing server-side session-scope enforcement (Vendor-released patch: 1.4.9, https://github.com/rustdesk/rustdesk/releases/tag/1.4.9; fix in PR #15469 / commit 493b14b). Until every endpoint and relay is updated, reduce exposure by only granting sessions to fully trusted peers and avoiding handing out limited session types (FileTransfer, PortForward, ViewCamera, Terminal) to parties you would not trust with full remote control, since the scope restriction cannot currently be relied upon; this trades away the convenience of delegating narrow, task-limited access. Where feasible, restrict which peers can connect at all - enforce strong per-device access passwords/permanent-password policies, disable unattended access for untrusted devices, and network-restrict access to the RustDesk relay/host so only known peers can initiate sessions - accepting the operational overhead of tighter access control as the trade-off.