Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

RustDesk bug bounty programs

rustdesk.com Updated

RustDesk runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
13
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program RustDesk runs.

  • RustDesk

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets. 6 excluded.

  • https://rustdesk.com

    Web

  • File transfer path handling in both directions, including traversal, symlinks and where a transferred file is allowed to land

    Products and areas

  • Local configuration storage, key material on disk and anything a local unprivileged user can read or modify to change who may connect

    Products and areas

  • The address book and the integration with a self-hosted API server, plus the credentials that connection uses

    Products and areas

  • The Android and iOS clients, including the accessibility and screen-capture paths the Android build depends on

    Products and areas

  • The desktop clients on Windows, macOS and Linux, along with the installer and the elevated service or daemon that runs alongside them

    Products and areas

  • The hbbr relay server, which forwards session traffic between two parties it does not authenticate end to end

    Products and areas

  • The hbbs rendezvous server: ID registration, peer lookup, the punch-through negotiation and everything it accepts from an unauthenticated internet host

    Products and areas

  • The identity model: the numeric ID, the permanent password, the one-time password and the exchange deciding whether a connection request is accepted

    Products and areas

  • The permission model on the controlled side, covering keyboard and mouse control, clipboard, file transfer, audio, TCP tunnelling, terminal access and the toggles supposed to restrict each of them

    Products and areas

  • The RustDesk protocol itself, covering the key exchange, session encryption, message framing and the codec paths carrying video and audio

    Products and areas

  • The security document asks for private reports to the project contact address and states there is no bounty. It sets no scope boundary, so the client, the self-hosted servers and the protocol between them are all in

    Products and areas

  • The web client and the wasm build

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • An operator handing out the connection ID and permanent password deliberately, which is the product working as designed

  • Deployments left with a default or empty permanent password the user never changed

  • Findings against a fork or a rebranded custom client build rather than the upstream repository

  • Social engineering of a user into approving a session, which is a support-scam problem rather than a code defect

  • The RustDesk commercial hosted service's own infrastructure and billing surface, as distinct from the open-source code

  • Upstream Rust crate and Flutter defects, unless RustDesk's own use of them is what makes the bug reachable

Recent changes

Reward and scope changes across every RustDesk program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in RustDesk products, from the NVD.

Search NVD
  • CVE-2026-30796 Medium

    Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks. The client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HT

  • CVE-2026-30797 Critical

    Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, config import modules) allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files flutter/lib/common.Dart and program routines importConfig() via URI handler. This issue affects RustDes

  • CVE-2026-30798 High

    Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop, strategy processing modules) allows Protocol Manipulation. This vulnerability is associated with program files src/hbbs_http/sync.Rs and program routines stop-service handler in hear

  • CVE-2026-30789 Medium

    Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Client login, peer authentication modules) allows Password Brute Forcing. The authentication proof is SHA256(SHA256(password + salt) + challenge), where both the salt and the c

  • CVE-2026-30792 High

    A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Strategy sync, HTTP API client, config options engine modules) allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files src/hbbs_http/sync.Rs, hbb_common/src/config.Rs and program routines Strategy merge loop in sync.Rs,

  • CVE-2026-30793 Critical

    Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart, src/flutter_ffi.Rs and program routines URI handler for rustdesk://password/, bind.MainSetPermanentPassword

  • CVE-2026-30795 High

    Cleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop modules) allows Sniffing Attacks. This vulnerability is associated with program files src/hbbs_http/sync.Rs and program routines Heartbeat JSON payload construction (preset-address-book-password). This issue affects RustDesk Cl

  • CVE-2026-30783 Medium

    A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) allows Privilege Abuse. This vulnerability is associated with program files src/rendezvous_mediator.Rs, src/hbbs_http/sync.Rs and program routines API sync loop, api-server config handling. This issue affects RustDesk Clie

About this page

This page gathers every public program listed under rustdesk.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.