Which versions of RustDesk are affected by CVE-2026-58056?

RustDesk contains an authorization bypass vulnerability (CVE-2026-58056, CVSS 7.2) allowing authenticated peers with limited file-transfer access to escalate into full interactive remote control and…

Is there a public PoC exploit available for CVE-2026-58056?

Yes, a public proof-of-concept exploit is available for CVE-2026-58056. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-58056?

Within 24 hours: audit active RustDesk deployments and identify sessions granted file-transfer authorization; categorize by system sensitivity. Within 7 days: restrict file-transfer authorization to non-sensitive systems and trusted networks only, revoke unnecessary RustDesk access, and implement network segmentation to contain lateral movement. Within 30 days: monitor official RustDesk advisories for patch availability; evaluate alternative remote access solutions with stronger capability-based access controls if RustDesk remains critical.

RustDesk CVE-2026-58056

Q: What is the CVSS score of CVE-2026-58056?

CVE-2026-58056 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39976 HIGH

Incorrect Authorization (CWE-863)

2026-06-28 VulnCheck

GHSA-vp3r-hwqm-x826

Authentication Bypass Rustdesk

7.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.6 HIGH

Network-reachable, low complexity, no UI; PR:L because a valid FileTransfer authorization is required; high integrity from input injection/control, lower confidentiality from screen capture and lower availability.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 28, 2026 - 02:32 vuln.today

CVSS changed

Jun 28, 2026 - 02:22 NVD

7.6 (HIGH) 7.2 (HIGH)

DescriptionCVE.org

RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.

AnalysisAI

Authorization scope bypass in RustDesk lets a peer holding only a FileTransfer authorization inject keyboard and mouse input and invoke the screenshot and display-capture handlers, escalating a limited file-transfer session into full interactive remote control and screen surveillance. The defect arises because RustDesk gates incoming control messages on per-capability flags that a file-transfer session never clears, rather than on the session's authorized connection type. Publicly available exploit code exists (reported by VulnCheck); no public active exploitation has been identified at time of analysis.

Technical ContextAI

RustDesk is a widely used open-source remote-desktop and remote-support application, identified by the single affected CPE cpe:2.3:a:rustdesk:rustdesk. The vulnerability is a CWE-863 (Improper Authorization) defect in the session-handling logic: incoming control messages are dispatched according to granular per-capability boolean flags instead of being validated against the connection type (e.g., FileTransfer versus full remote control) that the peer was actually authorized for. Because establishing a file-transfer session does not reset these capability flags, the keyboard/mouse input handlers and the screenshot/display-capture handlers stay reachable even though only file-transfer scope was negotiated. The root cause is conflating feature-level capability gating with session-level scope enforcement.

RemediationAI

No vendor-released patch version is identified in the provided data (No vendor-released patch identified at time of analysis), so the primary action is to track the VulnCheck advisory (https://www.vulncheck.com/advisories/rustdesk-filetransfer-session-authorization-scope-bypass) and the upstream RustDesk project for a fixed release and upgrade to the exact patched version as soon as it is published. Until then, apply compensating controls: stop granting FileTransfer-only authorizations to semi-trusted parties since the scope is not enforced (trade-off: less convenient file-only support); require interactive accept-prompt approval for every incoming connection instead of unattended auto-accept so a human gates each session (trade-off: unattended endpoints can no longer be served); enforce strong, unique permanent passwords or disable unattended access to shrink the pool of peers that can obtain any authorization; and restrict network reachability of RustDesk peers via firewall rules or by routing only through a controlled self-hosted relay/ID server. Validate the exact fixed version against the vendor advisory before relying on an upgrade, and do not assume an upstream commit equals a released build.