CVE-2026-58056: RustDesk Authorization Bypass via Uncleared Capability Flags

Technical summary

CVE-2026-58056 is an authorization bypass flaw in RustDesk stemming from improper separation of concerns between session-level authorization and per-capability permission checks. The vulnerability is rooted in CWE-863 (Incorrect Authorization). The application gates incoming control messages against individual capability flags without first validating the connection type under which those capabilities should be permitted. Specifically, a peer holding a valid FileTransfer authorization can craft or inject control messages to exercise keyboard input, mouse movement, screenshot capture, and display-capture functions. The root cause is the failure to clear or reset capability flags when transitioning into a file-transfer-only session, allowing persistence of capabilities beyond the intended scope.

Business impact

An authenticated insider or compromised account with only file-transfer privileges can silently monitor user activity, inject keystrokes for credential harvesting or malicious commands, and exfiltrate screen content without the victim's awareness. In multi-user or shared-device environments, this enables lateral movement and espionage. The damage is heightened because file-transfer access is often granted more liberally than full remote-control access, expanding the attack surface. Organizations relying on RustDesk for secure remote support or file synchronization may face undetected compromise of sensitive systems.

Affected systems

RustDesk is affected by this authorization bypass. The vendor and product list in the source record is empty; confirm the affected versions against the RustDesk security advisory, as the scope of affected releases is not specified in the provided data.

Exploitability

The vulnerability requires network access and valid authentication (CWE-863 vector: PR:L), meaning an attacker must possess a legitimate RustDesk account with at least file-transfer permissions. No user interaction is required to trigger the attack (UI:N). The CVSS 3.1 score of 7.6 (HIGH) reflects the combination of low access complexity (AC:L) and significant impact: low confidentiality loss (screen capture), high integrity risk (keyboard/mouse injection), and low availability impact. Exploitation is straightforward once authorized, as the attacker simply sends control messages that the application fails to properly gate.

Remediation

Apply a patched version of RustDesk that properly validates session authorization type before permitting capability-gated actions, and ensures capability flags are reset or scoped to the current session's authorized connection type. Verify the specific patch version against the official RustDesk advisory. Until patching is possible, restrict file-transfer-only permissions to trusted users, monitor for anomalous keyboard/mouse/screenshot activity on sessions labeled as file-transfer-only, and use network segmentation to limit RustDesk access to sensitive systems.

Patch guidance

Consult the RustDesk project's official security advisory for the specific patched version that resolves the capability-flag isolation issue. Apply the patch to all RustDesk instances, particularly those in production environments handling sensitive data or connected to critical systems. Verify the patch in a test environment before full rollout. Track the patch release date and ensure deployment across all managed endpoints within a defined maintenance window.

Detection guidance

Monitor RustDesk logs and network telemetry for file-transfer sessions that subsequently perform keyboard input, mouse movement, screenshot, or display-capture operations. Implement alerts on unexpected capability usage from sessions authorized only for file transfer. Use endpoint detection and response (EDR) tools to flag suspicious input injection or screen-capture activity correlated with RustDesk process execution. Review RustDesk session logs for authorization mismatches between the declared session type and the capabilities exercised.

Why prioritize this

This vulnerability merits immediate attention because it enables silent persistence and espionage by compromised or malicious insiders with low privilege levels. The combination of wide applicability (any RustDesk deployment), ease of exploitation (no special tools, only network access and valid credentials), and high business impact (undetected screen monitoring and keystroke injection) make it a preferred vector for attackers seeking to escalate or maintain access in multi-user environments. The HIGH CVSS score and the real-world likelihood of file-transfer-only accounts being issued to contractors or low-trust users elevate risk.

Risk score, explained

The CVSS 3.1 score of 7.6 (HIGH) is driven by: (1) network-accessible attack vector (AV:N); (2) low barriers to exploitation once authenticated (AC:L, PR:L, UI:N); (3) no requirement for user interaction; (4) significant integrity impact from keyboard and mouse injection (I:H) enabling command execution or credential theft; (5) confidentiality loss from unguarded screenshot and display-capture handlers (C:L); and (6) minor availability risk from potential DoS via injected input (A:L). The score does not account for the gating of exploitability to authenticated users, which limits but does not eliminate risk in shared or compromised-credential scenarios.

Frequently asked questions