neutrinolabs xrdp up to 0.10.5 Xvnc backend improper authorization

Summaryinfo

A vulnerability was found in neutrinolabs xrdp up to 0.10.5 and classified as very critical. The impacted element is an unknown function of the component Xvnc backend. The manipulation results in improper authorization. This vulnerability is identified as CVE-2026-55626. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in neutrinolabs xrdp up to 0.10.5. It has been classified as very critical. Affected is an unknown code of the component Xvnc backend. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-55626 since 06/17/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/20/2026). This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

Upgrading to version 0.10.6.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• neutrinolabs

Name

• xrdp

Version

• 0.10.0
• 0.10.1
• 0.10.2
• 0.10.3
• 0.10.4
• 0.10.5

Website

• Product: https://github.com/neutrinolabs/xrdp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion