CVE-2026-91949 in FreeRDP
Summary
by MITRE • 09/15/2026
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The FreeRDP server implementation prior to version 3.31.0 contains a critical logic flaw in its Remote Desktop Protocol (RDP) connection establishment sequence that allows for the circumvention of security policies designed to restrict unauthenticated access. This vulnerability specifically targets the protocol negotiation phase, where clients and servers agree on the transport layer and encryption methods before authentication occurs. Under normal operational conditions, administrators may configure FreeRDP servers to disable RDSTLS connections or require specific pre-authentication mechanisms to ensure that only authorized users can initiate sessions. However, due to an incomplete validation of the negotiated protocol version during the initial handshake, attackers are able to exploit this gap by manipulating the sequence of negotiation packets sent to the server.
The technical mechanism behind this bypass involves a carefully crafted series of incompatible protocol requests followed by a transition into RDSTLS mode without proper authorization checks. An unauthenticated attacker initiates contact with the FreeRDP server and sends standard RDP connection request messages that are intentionally designed to fail or be rejected based on policy constraints, such as disabled TLS support or restricted channel access. When these initial attempts result in negotiation failures, instead of terminating the session as expected under strict security policies, the client proceeds to complete a Transport Layer Security handshake independently. This action effectively forces the connection into RDSTLS mode, which is typically reserved for authenticated sessions requiring encrypted transport. Because the server fails to re-evaluate its access control lists and policy restrictions after this protocol shift, it accepts the established secure channel as valid despite the lack of prior authentication credentials.
This vulnerability falls under CWE-287 Improper Authentication because the system fails to properly verify identity before granting access to protected resources. Furthermore, from a threat intelligence perspective, this behavior aligns with MITRE ATT&CK technique T1078 Valid Accounts or more broadly T1190 Exploit Public-Facing Application, as it allows an external actor to bypass initial security controls on a service exposed to networks. The ability to establish RDSTLS connections without authentication significantly expands the attack surface for subsequent exploitation attempts. Once inside this encrypted tunnel, attackers can potentially launch further attacks such as credential dumping, lateral movement via RDP-based persistence mechanisms, or data exfiltration using legitimate-looking traffic that evades basic network monitoring tools designed to flag unencrypted or unauthorized connection types.
The operational impact of this flaw is severe for organizations relying on FreeRDP for remote access infrastructure. It effectively nullifies security policies intended to limit exposure during the pre-authentication phase, allowing malicious actors to penetrate internal networks without triggering standard alerts associated with failed login attempts. This can lead to unauthorized access to sensitive systems, potential compromise of user credentials through keylogging or clipboard interception within the session, and broader network intrusion if combined with other vulnerabilities in services accessible via RDP. The lack of proper state validation during protocol transitions represents a fundamental design oversight that undermines the principle of least privilege by granting elevated transport capabilities to unverified entities.
To mitigate this vulnerability, organizations must immediately upgrade FreeRDP server installations to version 3.31.0 or later where these logic flaws have been addressed through stricter enforcement of policy checks across all protocol negotiation stages. In environments where upgrading is not instantly feasible, network-level mitigations should be implemented by restricting inbound traffic on RDP ports using firewall rules that limit access to known IP addresses and implementing deep packet inspection solutions capable of detecting anomalous negotiation sequences indicative of this bypass attempt. Additionally, administrators should review their security policies to ensure that reliance solely on transport-layer restrictions is supplemented with robust network segmentation and multi-factor authentication requirements for all remote desktop sessions to reduce the risk posed by such protocol-level exploits.