CVE-2026-32107

xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to escalate privileges to root and execute arbitrary code on the system. An additional exploit would be needed to facilitate this. This issue has been fixed in version 0.10.6.

• CWE-273

• https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6Patch, Release Notes
• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-p5m6-7m43-pjv9Vendor Advisory

Published

Apr 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32101StudioCMS is a server-side-rendered, Astro native, headless …6.3
• CVE-2026-32102OliveTin gives access to predefined shell commands from a we…6.5
• CVE-2026-32103StudioCMS is a server-side-rendered, Astro native, headless …7.2
• CVE-2026-32104StudioCMS is a server-side-rendered, Astro native, headless …5.4
• CVE-2026-32105xrdp is an open source RDP server. In versions through 0.10.…7.7
• CVE-2026-32106StudioCMS is a server-side-rendered, Astro native, headless …7.2
• CVE-2026-32108Copyparty is a portable file server. Prior to 1.20.12, there…6.5
• CVE-2026-32109Copyparty is a portable file server. Prior to 1.20.12, if an…4.4
• CVE-2026-3211Cross-Site Request Forgery (CSRF) vulnerability in Drupal Th…4.3
• CVE-2026-32110SiYuan is a personal knowledge management system. Prior to 3…8.3
• CVE-2026-32111ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the h…5.3
• CVE-2026-32112ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the h…4.7