CVE-2026-30784

Description

Missing Authorization, Missing Authentication for Critical Function vulnerability in rustdesk-server RustDesk Server rustdesk-server, rustdesk-server-pro on hbbs/hbbr on all server platforms (Rendezvous server (hbbs), relay server (hbbr) modules) allows Privilege Abuse. This vulnerability is associated with program files src/rendezvous_server.Rs, src/relay_server.Rs and program routines handle_punch_hole_request(), RegisterPeer handler, relay forwarding. This issue affects RustDesk Server: through 1.7.5, through 1.1.15.

PUBLISHED Reserved 2026-03-05 | Published 2026-03-05 | Updated 2026-03-05 | Assigner VULSec

Problem types

CWE-862 Missing Authorization

CWE-306 Missing Authentication for Critical Function

Product status

Credits

Erez Kalman finder

Erez Kalman reporter

References

rustdesk.com/docs/en/self-host/ technical-description product

cve.org (CVE-2026-30784)

nvd.nist.gov (CVE-2026-30784)

Download JSON