CVE-2026-67289
Last modified
CVE-2026-67289 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| FreeRDP | FreeRDP | < 3.29.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-67289?
How severe is CVE-2026-67289?
How do I fix CVE-2026-67289?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-67283Joomla Extension - tabaoca.org - Improper ACL implementation…6.9
- CVE-2026-67284Joomla Extension - tabaoca.org - Improper ACL implementation…5.3
- CVE-2026-67285Joomla Extension - joomshaper.com - Unauthenticated arbitrar…9.2
- CVE-2026-67286Joomla Extension - joomshaper.com - Unauthenticated arbitrar…6.3
- CVE-2026-67287Joomla Extension - joomshaper.com - Unauthenticated comment …6.3
- CVE-2026-67288FreeRDP before 3.29.0 contains a null pointer dereference vu…8.7
- CVE-2026-6729HKUDS OpenHarness prior to PR #159 remediation contains a se…7.6
- CVE-2026-67290FreeRDP before 3.29.0 contains a heap out-of-bounds read vul…8.7
- CVE-2026-67291FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains…8.7
- CVE-2026-67292FreeRDP before 3.29.0 contains a buffer over-disclosure vuln…9.3
- CVE-2026-67293FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains…9.3
- CVE-2026-67294FreeRDP before 3.29.0 improperly validates the Extended Key …9.3
Are you affected by CVE-2026-67289?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST