CVE-2026-30793 is a flaw in RustDesk clients through version 1.4.5 that NVD scores 9.8. The Flutter URI handler for password links calls a function that sets the permanent password without the privilege check the command line enforces. The researcher's later notes say it is conditional. Update and keep deep link options off.
What's affected
The NVD record says RustDesk Client through 1.4.5 is affected. The researcher's findings document lists Linux, macOS, Windows and Android Flutter builds, and excludes iOS and web clients.
The researcher's June 2026 update narrows the picture. It says the rustdesk://config and rustdesk://password handlers are mobile only and are ignored unless the options allow-deep-link-server-settings or allow-deep-link-password are enabled. It says these options are off by default, as verified in 1.4.8, and that desktop is unaffected. The record gives no fixed version, so check the vendor release notes.
How to check if you're exposed
Check which RustDesk client versions are installed on your devices, from Help and About in the app. Then check the two options named above in the client configuration, on mobile devices in particular, and confirm both are off. List who uses RustDesk for remote access and whether devices use a permanent password for unattended access, since that password is what the flaw targets.
What to do now
- Update RustDesk clients to the latest release and read the release notes for deep link changes.
- Keep
allow-deep-link-passwordandallow-deep-link-server-settingsoff, and verify it on managed mobile devices. - If any device ran with deep links enabled, change its permanent password.
- Prefer one time or approved connections over a permanent password where you can.
- Track remote access tools in your software inventory, because they are high value targets.
Why it matters
The record files this under CWE-285, improper authorization, and CWE-352, cross-site request forgery. In simple terms, an action that needs privilege on one path, the command line, was reachable on another path, a link handler, with the check missing. A crafted link that a user opens could then change a setting on their behalf.
The NVD score of 9.8 describes the worst case. The researcher's own update says the issue is conditional and not the default, which makes the scores a poor guide to real risk and the configuration a good one. Remote access tools turn any password change into control of a machine, so the setting is worth confirming either way. The record does not mark this as exploited in the wild.
Quick check
Does this affect desktop RustDesk?
The researcher's update says desktop is unaffected and the handlers are mobile only and off by default. Verify your own configuration.
Is there a fixed version?
The record does not name one. Check RustDesk's release notes.
Sources
Last reviewed: 19 October 2026.
