CVE-2026-91949
FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass
- State
- Published
- Severity
- 9.2 Critical
- Published
- Sep 15, 2026
- Updated
- Sep 17, 2026
- Reserved
- Sep 15, 2026
Description
FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N | VulnCheck |
| 3.1 | 9.3 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-693 Protection Mechanism Failure
Affected Products
| Product | Versions |
|---|---|
FreeRDPFreeRDP |
|
References
- GitHub Security Advisory (GHSA-x7v6-xfx3-52j6)vendor-advisory
- VulnCheck Advisory: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.