Medium 6.9Published Mar 5, 2026

CVE-2026-30796RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync

Updated under an hour ago (Oct 28, 2026, 1:30 AM ET)

Does this affect you?

It affects rustdesk-client RustDesk Client and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for rustdesk-client RustDesk Client

Exploited in the last 30 days

Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks. The client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book. This vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password). This issue affects RustDesk Client: through 1.4.8.

CVSS: 6.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness (CWE): CWE-522
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VULSec
NVD analysis: Modified
Record last updated: Jul 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

rustdesk-client RustDesk Client rustdesk_client:rustdesk_client (from the name)	through 1.4.8; affected at Server Pro	CNA record
rustdesk rustdesk_server rustdesk:rustdesk_server	through 1.7.5	NVD

References

References

https://rustdesk.com/docs/en/	technical-description, x---config-documentation, product, vendor-advisory
https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub	third-party-advisory, exploit
https://www.vulsec.org/	vdb-entry, third-party-advisory, not-applicable

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.