CVE-2026-114047
Description
A flaw was found in FreeRDP. The FreeRDP proxy accepts untrusted target TLS certificates when no verification module is configured. A network-positioned attacker who can intercept the proxy's outbound connection can present a self-signed or wrong-hostname certificate to impersonate the RDP target and receive proxied session data. This issue affects FreeRDP from 2.0.0 before 3.32.0.
Statement
This issue is rated Moderate because exploitation requires a network man-in-the-middle position on the path between freerdp-proxy and the configured RDP target, and a user must initiate a proxied session (UI:R). Attack complexity is High because the attacker must intercept or redirect the proxy's outbound TLS connection and successfully present an accepted certificate when no rejecting verification module is configured. Successful exploitation can fully compromise confidentiality and integrity of the proxied RDP session, but availability impact is not demonstrated.
Mitigation
Restrict freerdp-proxy outbound connectivity to trusted RDP targets and trusted networks only. Configure an explicit TLS certificate verification module for the proxy's target connection and fail closed when verification is unavailable.
If freerdp-proxy is unused, remove or disable the freerdp-server/proxy packages.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 6.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
