- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 12
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://rustdesk.com
Products and areas 12
- File transfer path handling in both directions, including traversal, symlinks and where a transferred file is allowed to land
- Local configuration storage, key material on disk and anything a local unprivileged user can read or modify to change who may connect
- The address book and the integration with a self-hosted API server, plus the credentials that connection uses
- The Android and iOS clients, including the accessibility and screen-capture paths the Android build depends on
- The desktop clients on Windows, macOS and Linux, along with the installer and the elevated service or daemon that runs alongside them
- The hbbr relay server, which forwards session traffic between two parties it does not authenticate end to end
- The hbbs rendezvous server: ID registration, peer lookup, the punch-through negotiation and everything it accepts from an unauthenticated internet host
- The identity model: the numeric ID, the permanent password, the one-time password and the exchange deciding whether a connection request is accepted
- The permission model on the controlled side, covering keyboard and mouse control, clipboard, file transfer, audio, TCP tunnelling, terminal access and the toggles supposed to restrict each of them
- The RustDesk protocol itself, covering the key exchange, session encryption, message framing and the codec paths carrying video and audio
- The security document asks for private reports to the project contact address and states there is no bounty. It sets no scope boundary, so the client, the self-hosted servers and the protocol between them are all in
- The web client and the wasm build
Out of scope (6)
- An operator handing out the connection ID and permanent password deliberately, which is the product working as designed
- Deployments left with a default or empty permanent password the user never changed
- Findings against a fork or a rebranded custom client build rather than the upstream repository
- Social engineering of a user into approving a session, which is a support-scam problem rather than a code defect
- The RustDesk commercial hosted service's own infrastructure and billing surface, as distinct from the open-source code
- Upstream Rust crate and Flutter defects, unless RustDesk's own use of them is what makes the bug reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Report privately by email to the address on the policy page , the channel the project's security document names
-
State whether you attacked the public RustDesk infrastructure or a self-hosted deployment, and prefer a deployment you control for anything intrusive
-
Include the client platform and version on both ends.
-
Agree the disclosure point with the maintainers directly and hold the detail until a fixed release is available
Not accepted
-
Social engineering of a user into approving a session, which is a support-scam problem rather than a code defect
-
An operator handing out the connection ID and permanent password deliberately, which is the product working as designed
-
Deployments left with a default or empty permanent password the user never changed
-
Findings against a fork or a rebranded custom client build rather than the upstream repository
-
Upstream Rust crate and Flutter defects, unless RustDesk's own use of them is what makes the bug reachable
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-30796 | Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks. The client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HT | Medium 6.9 | 5 Mar 2026 |
| CVE-2026-30797 | Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, config import modules) allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files flutter/lib/common.Dart and program routines importConfig() via URI handler. This issue affects RustDes | Critical 9.3 | 5 Mar 2026 |
| CVE-2026-30798 | Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop, strategy processing modules) allows Protocol Manipulation. This vulnerability is associated with program files src/hbbs_http/sync.Rs and program routines stop-service handler in hear | High 8.2 | 5 Mar 2026 |
| CVE-2026-30789 | Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Client login, peer authentication modules) allows Password Brute Forcing. The authentication proof is SHA256(SHA256(password + salt) + challenge), where both the salt and the c | Medium 5.7 | 5 Mar 2026 |
| CVE-2026-30792 | A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Strategy sync, HTTP API client, config options engine modules) allows Application API Message Manipulation via Man-in-the-Middle. This vulnerability is associated with program files src/hbbs_http/sync.Rs, hbb_common/src/config.Rs and program routines Strategy merge loop in sync.Rs, | High 8.3 | 5 Mar 2026 |
| CVE-2026-30793 | Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated with program files flutter/lib/common.Dart, src/flutter_ffi.Rs and program routines URI handler for rustdesk://password/, bind.MainSetPermanentPassword | Critical 9.3 | 5 Mar 2026 |
| CVE-2026-30795 | Cleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop modules) allows Sniffing Attacks. This vulnerability is associated with program files src/hbbs_http/sync.Rs and program routines Heartbeat JSON payload construction (preset-address-book-password). This issue affects RustDesk Cl | High 8.7 | 5 Mar 2026 |
| CVE-2026-30783 | A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) allows Privilege Abuse. This vulnerability is associated with program files src/rendezvous_mediator.Rs, src/hbbs_http/sync.Rs and program routines API sync loop, api-server config handling. This issue affects RustDesk Clie | Medium 4.8 | 5 Mar 2026 |
| CVE-2026-30785 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbb_common on Windows, MacOS, Linux (Password security module, config encryption, machine UID modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program | High 8.2 | 5 Mar 2026 |
| CVE-2026-30791 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Config import, URI scheme handler, CLI --config modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files flutter/lib/common.Dart, hbb_common/src/config.Rs and program routines parseRustdeskU | High 8.7 | 5 Mar 2026 |
| CVE-2026-3598 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux (Config string generation, web console export modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program routines Config export/generation routines. This issue affects RustDesk Server Pro: through 1.7.5. | High 8.7 | 5 Mar 2026 |
| CVE-2024-25140 | A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid from 2023 until 2033. This is potentially unwanted, e.g., because there is no public documentation of security measures for the private key, and arbitrary software could be signed if the private key were | Critical 9.8 | 6 Feb 2024 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Latest advisories Loading the feed Overview RustDesk is the open-source answer to TeamViewer and AnyDesk, and it has become the default choice when an organisation wants remote desktop without a per-seat licence. The self-hosted hbbs rendezvous and hbbr relay servers are internet-facing by design, and the software on the far end holds full control of somebody's screen, keyboard, clipboard and filesystem. A bug that lets one party reach a session it does not own is hands-on-keyboard access to a real machine. The project states plainly that it has no bug bounty programme and describes itself as a small team on a big problem, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The security document asks for private reports to the project contact address and states there is no bounty. It sets no scope boundary, so the client, the self-hosted servers and the protocol between them are all in The hbbs rendezvous server: ID registration, peer lookup, the punch-through negotiation and everything it accepts from an unauthenticated internet host The hbbr relay server, which forwards session traffic between two parties it does not authenticate end to end The RustDesk protocol itself, covering the key exchange, session encryption, message framing and the codec paths carrying video and audio The identity model: the numeric ID, the permanent password, the one-time password and the exchange deciding whether a connection request is accepted The permission model on the controlled side, covering keyboard and mouse control, clipboard, file transfer, audio, TCP tunnelling, terminal access and the toggles supposed to restrict each of them File transfer path handling in both directions, including traversal, symlinks and where a transferred file is allowed to land The desktop clients on Windows, macOS and Linux, along with the installer and the elevated service or daemon that runs alongside them The Android and iOS clients, including the accessibility and screen-capture paths the Android build depends on The web client and the wasm build Local configuration storage, key material on disk and anything a local unprivileged user can read or modify to change who may connect The address book and the integration with a self-hosted API server, plus the credentials that connection uses Out of scope The RustDesk commercial hosted service's own infrastructure and billing surface, as distinct from the open-source code An operator handing out the connection ID and permanent password deliberately, which is the product working as designed Deployments left with a default or empty permanent password the user never changed Findings against a fork or a rebranded custom client build rather than the upstream repository Upstream Rust crate and Flutter defects, unless RustDesk's own use of them is what makes the bug reachable Social engineering of a user into approving a session, which is a support-scam problem rather than a code defect Most-valued findings Any path where a connection is accepted without the correct permanent password or one-time password, because the accepted session is full interactive control of the target machine Impersonation or hijack at the rendezvous server: claiming another peer's ID, redirecting a lookup, or inserting yourself into a session negotiation between two legitimate parties Cryptographic weaknesses in the key exchange or session encryption that let the relay operator, or anyone on the path, read or modify a session the relay is only supposed to forward Permission model bypass on the controlled side, above all reaching file transfer, clipboard, terminal or TCP tunnelling when the operator granted view-only access File transfer path traversal, since the controlled agent commonly runs as a service with system privileges and an arbitrary write there is a local privilege escalation Memory-unsafe or panic-inducing input in the relay and rendezvous servers, which are exposed to unauthenticated internet hosts by design Local privilege escalation through the installed Windows service, the Linux daemon or the installer, given that the agent already holds the privilege an attacker wants Recovery of stored credentials, the permanent password or key material from local configuration by an unprivileged process on the same machine Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately by email to [email protected] , the channel the project's security document names GitHub private vulnerability reporting is disabled on rustdesk/rustdesk , so the advisory button is not available here even though it is the norm elsewhere in this category The security document lives at docs/SECURITY.md rather than the repository root, so read it there before assuming a channel State whether you attacked the public RustDesk infrastructure or a self-hosted deployment, and prefer a deployment you control for anything intrusive Include the client platform and version on both ends. The controlled side behaves very differently on Windows with the elevated service installed than it does on a portable run The project states it has no bug bounty programme. There is no payment to negotiate and no reward terms to accept Disclosure Coordinated privately by email with a small commercial team that does not publish GitHub Security Advisories, so there is often no advisory to wait for and no CVE minted. Fixes appear in a tagged release. Agree the disclosure point with the maintainers directly and hold the detail until a fixed release is available, because self-hosted relays and installed clients update slowly and the deployed base stays exposed long after the commit lands. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability