CVE-2026-33145

xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrdp-sesman. When the AllowAlternateShell setting is enabled (which is the default when not explicitly configured), xrdp accepts a client-supplied AlternateShell value and executes it via /bin/sh -c during session initialization. This results in shell-interpreted execution of unsanitized, user-controlled input. This behavior effectively provides a scriptable remote command execution primitive over RDP within the security context of the authenticated user, occurring prior to normal window manager startup. This can bypass expected session initialization flows and operational assumptions that restrict execution to interactive desktop environments. This issue has been fixed in version 0.10.6.

• CWE-78

• https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6Patch, Release Notes
• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rmvv-7633-fg7hVendor Advisory

Published

Apr 17, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3314Missing password field masking vulnerability in Hitachi Ops …4.6
• CVE-2026-33140PySpector is a static analysis security testing (SAST) Frame…6.1
• CVE-2026-33141Chamilo LMS is a learning management system. Prior to 2.0.0-…6.5
• CVE-2026-33142OneUptime is a solution for monitoring and managing online s…8.1
• CVE-2026-33143OneUptime is a solution for monitoring and managing online s…7.5
• CVE-2026-33144GPAC is an open-source multimedia framework. Prior to commit…7.8
• CVE-2026-33146Docmost is open-source collaborative wiki and documentation …4.3
• CVE-2026-33147GMT is an open source collection of command-line tools for m…7.8
• CVE-2026-33148Tandoor Recipes is an application for managing recipes, plan…6.5
• CVE-2026-33149Tandoor Recipes is an application for managing recipes, plan…8.1
• CVE-2026-3315Incorrect Default Permissions, : Execution with Unnecessary …7.8
• CVE-2026-33150libfuse is the reference implementation of the Linux FUSE. F…7.8