---
id: CVE-2026-30796
title: >-
  Cleartext Transmission of Sensitive Information, Insufficiently Protected
  Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client
  on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop
  modules…
summary: >-
  Cleartext Transmission of Sensitive Information, Insufficiently Protected
  Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client
  on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop
  modules…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-522
published: '2026-03-05'
updated: '2026-06-22'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-30796'
references:
  - url: >-
      https://docs.google.com/document/d/e/2PACX-1vSds6jjpd38oO_yIAyd1HYtKNUuea-I-ozAPpGhYI7QgAU-QGJ7D8a4rOZVj1vmiUXV1EcdRHf9aZAW/pub
    label: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
  - url: 'https://rustdesk.com/docs/en/'
    label: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
  - url: 'https://www.vulsec.org/'
    label: 2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe
tags:
  - nvd
epss: 0.00487
epssPercentile: 0.39337
ingestedAt: '2026-06-29T13:24:34.789Z'
---

## Overview

Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks.

The client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the automatic invalid-certificate TLS downgrade (CVE-2026-30794) or a re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book.

This vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password).

This issue affects RustDesk Client: through 1.4.8.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.