CVE-2026-55626

Katalog CVE

CVSS 7.3 · High EPSS 0,19%

Kerentanan Improper Authentication pada neutrinolabs xrdp. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

28 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-m3xx-cpc4-982r advisory vendor
• https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1 product · release notes