RustDesk High-Risk Alert: Botnet Scans Continue, New Wave of Critical Vulnerabilities Arrives
If you’re using RustDesk, 2026 might be the year you need to pay the most attention to security.
In the first half of the year, botnets were scanning the entire internet for RustDesk IDs, launching automated attacks. Before the second half even began, security teams disclosed over a dozen RustDesk-related CVEs, several with CVSS scores of 9.8 (Critical), targeting core modules like client authentication, server security, and password storage.
One sentence summary of the current situation: RustDesk’s open-source remote desktop experience is still excellent, but if you haven’t hardened your security configuration, your devices may be exposed to the internet, waiting for someone to walk in.
High Risk #1: Botnet Scanning the Entire Internet for RustDesk Ports
In late January to early February 2026, the RustDesk development team issued an urgent security advisory on GitHub — a botnet was conducting automated attacks against RustDesk instances across the internet.
Attack Method
The botnet scans the entire internet for exposed RustDesk IDs, then automatically initiates remote connection requests. Affected users will see a connection invitation from a client named “Go Client” pop up.
The attack doesn’t rely on any security vulnerability — it’s a pure social engineering attack. If you accidentally click “Accept,” your device becomes botnet-controlled.
Once compromised, the attacker can execute automated commands to deploy malware, establish persistence, and then that machine becomes part of the botnet, continuing to scan for the next wave of victims.
Attack Characteristics
- Automated scanning: The botnet randomly scans the internet for RustDesk IDs
- Multiple IPs, multiple IDs: Attacks come from different IP addresses and different connection IDs
- Password-independent: Under default settings, the local user only needs to click “Accept” to establish a connection
- Scalable: The size of the botnet means it will keep trying, and someone will inevitably click wrong
Official Defense Recommendations
The RustDesk development team gave very clear recommendations:
- Never click “Accept Connection” requests from unknown sources
- Go to Security Settings and change the connection method to “Require Password” — accepting alone is not enough; the correct password must be entered to connect
- Set a strong password
- Switch to self-hosted mode, and do not expose your server IP and public key
- Enable two-factor authentication or IP whitelisting
- Upgrade to Pro (self-hosted) and use ACLs for more granular access control
The second recommendation is the simplest and most effective — change “Accept Connection Request” to “Use Password.” Most users don’t have this option enabled by default, and a simple setting change blocks the vast majority of automated attacks.
High Risk #2: Large Number of Critical Vulnerabilities Disclosed in Mid-2026
If the botnet attacks were a “man-made disaster,” what follows is the “internal threat.”
Between March and June 2026, multiple security research teams disclosed a large number of RustDesk security vulnerabilities. Several were rated CVSS 9.8 (Critical), affecting the core security mechanisms of both client and server.
Here are the ones you should pay the most attention to:
CVE-2026-30789 (CVSS 9.8) — Client Password Brute Force
The problem: The password hashing scheme used by the RustDesk client is SHA256(SHA256(password + salt) + challenge). This scheme claims to have salting and challenge codes, but its biggest flaw is — it doesn’t use a slow hash function (KDF).
Regular SHA256 is designed to be fast. On a modern GPU, billions of hash operations can be attempted per second. Even with a salt, this password scheme can be cracked in hours rather than years.
Impact: Attackers who intercept network traffic can perform offline brute-force attacks on passwords at GPU speeds. Combined with a weak password, the attacker can gain full remote control of the device.
Official fix: Upgrade to RustDesk 1.3.8 or later, which has switched to a KDF (Argon2) based password verification scheme. If you’re still on an older version, change it now — and set a complex password while you’re at it.
CVE-2026-30790 (CVSS 9.8) — HMAC Verification Bypass
This is an even more fundamental security design flaw: the HMAC verification in the server’s connection protocol uses an empty key (HMAC(key="", msg)). Anyone who knows the protocol details can forge valid HMACs and pretend to be a legitimate client to connect to any RustDesk server.
Impact: No password guessing needed — if your server accepts connections from unknown clients, attackers can connect directly by forging authentication data.
Official fix: Upgrade to the latest version. The HMAC verification mechanism has been redesigned.
CVE-2026-30791 (CVSS 9.8) — Stored Password Encryption Weakness
The RustDesk client stores passwords locally in a configuration file. The encryption method… uses a hardcoded key. Any attacker who gains access to the configuration file (or reads it via another vulnerability) can decrypt the stored passwords directly.
In other words: even if you’ve set a strong password, if someone gets your config file, the password is essentially public.
Official fix: Latest version uses system keychain storage (such as GNOME Keyring/KDE Wallet), no longer relying on hardcoded keys.
CVE-2026-30792 (CVSS 9.8) — Unauthenticated TCP Port Exposure
By default, RustDesk listens on TCP port 21118 for incoming connections. Before authentication, this port responds to certain protocol handshakes — attackers can use this for scanning and reconnaissance. If the server also has other vulnerabilities, this port becomes the entry point.
Official fix: The new version restricts the port’s response behavior before authentication to reduce information leakage.
Protection Checklist
If you’re continuing to use RustDesk, please check each of these items:
- ✅ Upgraded to 1.3.8+? — fixes multiple critical vulnerabilities
- ✅ Password required for connections? — blocks social engineering botnet attacks
- ✅ Strong password set? — at least 16 characters, mixed case + numbers + symbols
- ✅ Self-hosted mode? — not relying on the public relay server
- ✅ ACL/IP whitelist configured? — limits access to known IPs only
- ✅ Key relay turned off? — prevents relay node attacks
- ✅ Two-factor authentication enabled? — second layer of defense
Should You Still Use RustDesk?
Short answer: Yes, but pay attention to configuration.
RustDesk’s architecture and experience still make it the best open-source alternative to TeamViewer/AnyDesk. Its self-hosted, end-to-end encrypted design is fundamentally more trustworthy than proprietary software.
But the 2026 vulnerability storm tells us: open-source is not a security silver bullet. When open-source software becomes popular, it attracts both security researchers (who help improve it) and attackers (who exploit it). RustDesk is currently going through this phase.
The solution isn’t to abandon RustDesk, but to: upgrade, harden, monitor.
After all, any remote desktop software, if not properly configured, is a backdoor to your devices. RustDesk is no exception.
Comments