CVE-2026-114047 in FreeRDP
Summary
by MITRE • 10/22/2026
FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the FreeRDP software suite, specifically affecting versions ranging from 2.0.0 up to but not including 3.32.0. This security flaw is located in the proxy component of the application and stems from an improper implementation of certificate validation during Transport Layer Security handshakes. In a properly secured environment, any client acting as a proxy must rigorously verify that the server's presented TLS certificate is signed by a trusted Certificate Authority and matches the expected hostname or IP address. However, in this specific configuration scenario where no verification module is explicitly configured, FreeRDP fails to perform these critical checks. Consequently, the software accepts untrusted target TLS certificates without raising an alert or terminating the connection, effectively bypassing standard cryptographic authentication mechanisms designed to prevent man-in-the-middle attacks.
This technical deficiency creates a significant operational risk by allowing network-positioned attackers to execute sophisticated interception strategies. An adversary positioned within the same network segment can intercept the outbound connections initiated by the FreeRDP proxy. By presenting a self-signed certificate or one with an incorrect hostname, the attacker can successfully impersonate the legitimate Remote Desktop Protocol target. Because the vulnerable version of FreeRDP does not validate the authenticity or subject alternative names of this presented certificate, it proceeds to establish an encrypted session with the malicious entity. This results in the proxy forwarding sensitive proxied session data directly to the attacker rather than the intended destination server.
The impact of this vulnerability is severe, as it compromises both confidentiality and integrity for remote desktop sessions routed through the affected proxy. Attackers can potentially exfiltrate credentials, keystrokes, screen contents, and other sensitive information transmitted during the RDP session. Furthermore, because the connection appears encrypted to the user, there may be no immediate indication that the communication channel has been compromised. This aligns with Common Weakness Enumeration identifier CWE-295, which describes Improper Certificate Validation, a flaw often exploited in conjunction with MITM attacks categorized under ATT&CK technique T1048, specifically Exfiltration Over Alternative Protocol or interception of encrypted traffic when validation is weak.
To mitigate this risk, organizations utilizing FreeRDP proxies must ensure that the software version is updated to 3.32.0 or later, where these validation checks have been strengthened. For environments running older versions that cannot be immediately patched, it is imperative to explicitly configure a verification module within the proxy settings rather than relying on default behaviors. Administrators should enforce strict certificate pinning or require connections only from known and trusted Certificate Authorities. Additionally, network segmentation strategies can limit the ability of unauthorized actors to position themselves between the client and the target server, thereby reducing the attack surface available for exploitation of this specific validation flaw.