{"id":"CVE-2026-55626","aliases":["DEBIAN-CVE-2026-55626","EUVD-2026-46041","GHSA-m3xx-cpc4-982r","MGASA-2026-0566","UBUNTU-CVE-2026-55626","openSUSE-SU-2026:11543-1"],"status":"published","title":"xrdp: No authentication required with Xvnc backend on RHEL 9","description":"xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00187,"percentile":0.0843,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-306"],"published":"2026-07-20T17:11:44Z","modified":"2026-10-30T01:28:13Z","fixes":[{"ecosystem":"Debian:14","package":"xrdp","fixed_in":["0.10.6.1-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6.1-2"}]}],"versions":["0.10.1-3.1","0.10.1-4","0.10.1-4.1","0.10.2-1","0.10.2-2","0.10.4.1-1","0.10.4.1-2","0.10.5-1","0.10.5-2","0.10.5-3","0.10.5-4","0.10.5-5","0.10.6-1","0.10.6-2","0.10.6-3","0.10.6-4","0.10.6-5","0.10.6.1-1","0.10.6.1-2~bpo13+1"]},{"source":"osv","ecosystem":"Mageia:10","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6.1-2.mga10"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.0-1","0.6.0-1ubuntu0.1","0.6.0-1ubuntu0.1+esm1","0.6.0-1ubuntu0.1+esm2","0.6.0-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.1-2","0.6.1-2ubuntu0.1","0.6.1-2ubuntu0.3","0.6.1-2ubuntu0.3+esm1","0.6.1-2ubuntu0.3+esm2","0.6.1-2ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-9","0.9.4-1","0.9.4-2","0.9.4-3","0.9.4-4","0.9.4-5","0.9.5-1","0.9.5-1build1","0.9.5-2","0.9.5-2ubuntu0.1~esm1","0.9.5-2ubuntu0.1~esm2","0.9.5-2ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.9-1","0.9.12-1","0.9.12-1ubuntu0.1","0.9.12-1ubuntu0.1+esm1","0.9.12-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.15-1ubuntu1","0.9.17-1","0.9.17-2","0.9.17-2ubuntu1","0.9.17-2ubuntu2","0.9.17-2ubuntu2+esm1","0.9.17-2ubuntu3","0.9.17-2ubuntu3+esm1","0.9.17-2ubuntu3+esm2","0.9.17-2ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.21.1-1","0.9.24-2","0.9.24-3","0.9.24-3build1","0.9.24-3build2","0.9.24-4","0.9.24-4ubuntu0.1~esm1","0.9.24-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.1-3","0.10.1-3.1","0.10.1-3.1+deb13u1build0.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.1-4.1","0.10.6.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.1-3.1","0.10.1-4","0.10.1-4.1","0.10.1-4.1ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xrdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.6.1-1.1"}]}],"bundled":10}],"products":[{"vendor":"neutrinolabs","product":"xrdp"}],"references":[{"url":"https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-m3xx-cpc4-982r","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","report"]},{"url":"https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55626.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55626","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-55626","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0566.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35945","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5ZQ6QE47Z3SMILAAOHQ2RKDQFJOK2M4X/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JWYOEVBA3574FXNPXKDS3FPNCQ3SDAOM/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00380.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-55626","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55626","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55626","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55645","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-55626","title":"xrdp: No authentication required with Xvnc backend on RHEL 9","description":"xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.","status":"published","published":"2026-07-20T17:11:44.442Z","modified":"2026-07-24T20:17:30.075Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-306","CWE-287"],"updated_at":"2026-11-02T14:20:12.260247Z"}],"euvd":[{"id":"EUVD-2026-46041","description":"xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.","status":"published","published":"2026-07-20T17:11:44Z","modified":"2026-07-24T20:17:30Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T18:19:38.612768Z"}],"nvd":[{"id":"CVE-2026-55626","description":"xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.","status":"published","published":"2026-07-20T18:16:54.15Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"primary"}],"cwes":["CWE-287","CWE-306"],"updated_at":"2026-11-02T14:12:31.024898Z"}],"osv":[{"id":"CVE-2026-55626","title":"xrdp: No authentication required with Xvnc backend on RHEL 9","description":"xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.","status":"published","published":"2026-07-20T17:11:44.442Z","modified":"2026-10-28T02:30:28.340071371Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-287","CWE-306"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"DEBIAN-CVE-2026-55626","description":"xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.","status":"published","published":"2026-07-20T18:16:54.15Z","modified":"2026-10-25T09:47:38.343960602Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"UBUNTU-CVE-2026-55626","description":"xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.","status":"published","published":"2026-07-20T18:16:00Z","modified":"2026-10-17T12:59:07.975409979Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"MGASA-2026-0566","title":"Updated xrdp package fixes security vulnerabilities","description":"lib_palette_update Heap Buffer Overflow \u0026 RCE. (CVE-2026-41252)\nlib_framebuffer_update Has Integer Overflow Heap Info Leak \u0026 ASLR\nBypass. (CVE-2026-41521)\nChannel Data Forwarding Fixed-Size Buffer Overflow. (CVE-2026-44178)\nXRDP is vulnerable to a server timing attack, leading to user\nenumeration. (CVE-2026-42218)\nUnchecked FIPS padding length in standard RDP Security causes heap\nout-of-bounds read in HMAC verification. (CVE-2026-44978)\nPre-auth infinite loop via totalLength=0 in TS_SHARECONTROLHEADER.\n(CVE-2026-54538)\nMalformed Confirm Active capability sets cause out-of-bounds reads.\n(CVE-2026-55238)\nNo authentication required with Xvnc backend. (CVE-2026-55626)\nOut-of-bounds read in GCC Conference Create Request CS_SECURITY\nprocessing (xrdp_sec_process_mcs_data_CS_SECURITY). (CVE-2026-55639)\nOut-of-bounds read in Client Control PDU processing\n(xrdp_rdp_process_data_control). (CVE-2026-55645)\n","status":"published","published":"2026-10-30T01:10:00Z","modified":"2026-10-30T01:28:13.647254405Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11543-1","title":"xrdp-0.10.6.1-1.1 on GA media","description":"These are all security issues fixed in the xrdp-0.10.6.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-18T00:00:00Z","modified":"2026-08-19T18:23:34.611687905Z","updated_at":"2026-11-02T16:58:39.516824Z"}]}}