Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-91949

critical

CVE-2026-91949

freerdp: FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass

Published Modified CWE 693
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

Red Hat9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Trivy's own label is CRITICAL. Rated critical by Red Hat, AlmaLinux, Oracle, Rocky Linux. Rated lower by Amazon (high), Ubuntu (medium).

Description

FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections despite server policy disabling them. Attackers can send incompatible protocol requests, receive negotiation failures, then complete TLS handshake and enter RDSTLS to bypass pre-authentication transport restrictions.

Affected packages and fixed versions

SourcePackageFixed in
alma 10freerdp, freerdp-devel, freerdp-libs and 3 more2:3.10.3-12.el10_2.13
rocky 10freerdp, freerdp-libs, libwinpr2:3.10.3-12.el10_2.13
amazon linux 2023freerdp, freerdp-debuginfo, freerdp-debugsource and 8 more2:3.31.0-1.amzn2023
debian 13freerdp3no fix listed
debian 14freerdp33.31.0+dfsg-1
echofreerdp3no fix listed
rapidfort alma 10freerdp, freerdp-devel, freerdp-libs and 3 more2:3.10.3-12.el10_2.13
rapidfort alpine 3.20freerdp3.31.0-r0
rapidfort alpine 3.21freerdp3.31.0-r0
rapidfort alpine 3.22freerdp3.31.0-r0
rapidfort alpine 3.23freerdp3.31.0-r0
rapidfort alpine 3.24freerdp3.31.0-r0
Show all 56 entries from 19 sources
SourcePackageFixed in
alma 10freerdp2:3.10.3-12.el10_2.13
alma 10freerdp-devel2:3.10.3-12.el10_2.13
alma 10freerdp-libs2:3.10.3-12.el10_2.13
alma 10freerdp-server2:3.10.3-12.el10_2.13
alma 10libwinpr2:3.10.3-12.el10_2.13
alma 10libwinpr-devel2:3.10.3-12.el10_2.13
rocky 10freerdp2:3.10.3-12.el10_2.13
rocky 10freerdp-libs2:3.10.3-12.el10_2.13
rocky 10libwinpr2:3.10.3-12.el10_2.13
amazon linux 2023freerdp2:3.31.0-1.amzn2023
amazon linux 2023freerdp-debuginfo2:3.31.0-1.amzn2023
amazon linux 2023freerdp-debugsource2:3.31.0-1.amzn2023
amazon linux 2023freerdp-devel2:3.31.0-1.amzn2023
amazon linux 2023freerdp-libs2:3.31.0-1.amzn2023
amazon linux 2023freerdp-libs-debuginfo2:3.31.0-1.amzn2023
amazon linux 2023freerdp-server2:3.31.0-1.amzn2023
amazon linux 2023freerdp-server-debuginfo2:3.31.0-1.amzn2023
amazon linux 2023libwinpr2:3.31.0-1.amzn2023
amazon linux 2023libwinpr-debuginfo2:3.31.0-1.amzn2023
amazon linux 2023libwinpr-devel2:3.31.0-1.amzn2023
debian 13freerdp3no fix listed
debian 14freerdp33.31.0+dfsg-1
echofreerdp3no fix listed
rapidfort alma 10freerdp2:3.10.3-12.el10_2.13
rapidfort alma 10freerdp-devel2:3.10.3-12.el10_2.13
rapidfort alma 10freerdp-libs2:3.10.3-12.el10_2.13
rapidfort alma 10freerdp-server2:3.10.3-12.el10_2.13
rapidfort alma 10libwinpr2:3.10.3-12.el10_2.13
rapidfort alma 10libwinpr-devel2:3.10.3-12.el10_2.13
rapidfort alpine 3.20freerdp3.31.0-r0
rapidfort alpine 3.21freerdp3.31.0-r0
rapidfort alpine 3.22freerdp3.31.0-r0
rapidfort alpine 3.23freerdp3.31.0-r0
rapidfort alpine 3.24freerdp3.31.0-r0
rapidfort amazon linux 2023freerdp2:3.31.0-1.amzn2023
rapidfort amazon linux 2023freerdp-devel2:3.31.0-1.amzn2023
rapidfort amazon linux 2023freerdp-libs2:3.31.0-1.amzn2023
rapidfort amazon linux 2023freerdp-server2:3.31.0-1.amzn2023
rapidfort amazon linux 2023libwinpr2:3.31.0-1.amzn2023
rapidfort amazon linux 2023libwinpr-devel2:3.31.0-1.amzn2023
rapidfort debian 12freerdp30:3.31.0+dfsg-1
rapidfort debian 13freerdp30:3.31.0+dfsg-1
rapidfort fedora 43freerdp2:3.31.0-1.fc43
rapidfort fedora 43freerdp-devel2:3.31.0-1.fc43
rapidfort fedora 43freerdp-libs2:3.31.0-1.fc43
rapidfort fedora 43freerdp-server2:3.31.0-1.fc43
rapidfort fedora 43libwinpr2:3.31.0-1.fc43
rapidfort fedora 43libwinpr-devel2:3.31.0-1.fc43
rapidfort Oracle Linux 10freerdp2:3.10.3-12.el10_2.13
rapidfort Oracle Linux 10freerdp-devel2:3.10.3-12.el10_2.13
rapidfort Oracle Linux 10freerdp-libs2:3.10.3-12.el10_2.13
rapidfort Oracle Linux 10freerdp-server2:3.10.3-12.el10_2.13
rapidfort Oracle Linux 10libwinpr2:3.10.3-12.el10_2.13
rapidfort Oracle Linux 10libwinpr-devel2:3.10.3-12.el10_2.13
ubuntu 24.04freerdp33.31.0+dfsg-0ubuntu0.24.04.1
ubuntu 26.04freerdp33.31.0+dfsg-0ubuntu0.26.04.1

References

All 15 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.