CVE-2026-32105

xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the "Classic RDP Security" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity.

• CWE-354

• https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6Patch, Release Notes
• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j2jm-c596-c5q3Vendor Advisory

Published

Apr 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3210Incorrect Authorization vulnerability in Drupal Material Ico…5.3
• CVE-2026-32100Shopware is an open commerce platform. /api/_info/config rou…5.3
• CVE-2026-32101StudioCMS is a server-side-rendered, Astro native, headless …6.3
• CVE-2026-32102OliveTin gives access to predefined shell commands from a we…6.5
• CVE-2026-32103StudioCMS is a server-side-rendered, Astro native, headless …7.2
• CVE-2026-32104StudioCMS is a server-side-rendered, Astro native, headless …5.4
• CVE-2026-32106StudioCMS is a server-side-rendered, Astro native, headless …7.2
• CVE-2026-32107xrdp is an open source RDP server. In versions through 0.10.…8.8
• CVE-2026-32108Copyparty is a portable file server. Prior to 1.20.12, there…6.5
• CVE-2026-32109Copyparty is a portable file server. Prior to 1.20.12, if an…4.4
• CVE-2026-3211Cross-Site Request Forgery (CSRF) vulnerability in Drupal Th…4.3
• CVE-2026-32110SiYuan is a personal knowledge management system. Prior to 3…8.3