CVE-2026-91949

Executive Summary

CVE-2026-91949 is a critical protocol negotiation bypass (CWE-693, Protection Mechanism Failure) in the FreeRDP server affecting all versions prior to 3.31.0. Unauthenticated, remote attackers can deliberately send incompatible protocol requests, observe the resulting negotiation failure, then complete a TLS handshake and proceed into RDSTLS even when server policy has explicitly disabled RDSTLS connections. Successful exploitation defeats pre-authentication transport restrictions, exposing the server's RDP authentication surface and internal sessions to attackers who should never have reached that stage. With a CVSS base score of 9.3, scope change, and no required privileges or user interaction, this vulnerability represents a serious pre-auth exposure for any organization running an unpatched FreeRDP server.

Technical Analysis

FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), and its server component negotiates the transport and security layer (standard RDP security, TLS, CredSSP/NLA, and RDSTLS) before authentication begins. RDSTLS is a specialized RDP security protocol used to carry authentication credentials (for example, reconnect cookies) over a TLS channel. Many deployments disable RDSTLS because it exposes a pre-authentication path that can be abused for password spraying, credential relay, or session hijacking, and because it widens the attack surface before NLA is enforced.

CVE-2026-91949 is classified as CWE-693, Protection Mechanism Failure. The vulnerability exists in the protocol negotiation logic: the server is supposed to reject RDSTLS when policy disables it, but the negotiation state machine can be driven into a state where the policy check is bypassed. According to the NVD description, an unauthenticated attacker can:

1. Send protocol requests that are incompatible with the server's configured capabilities, causing the server to return a negotiation failure.
2. After that failure response, complete a TLS handshake with the server.
3. Enter RDSTLS and establish an RDSTLS connection, despite the server policy that disables RDSTLS.

The core weakness is that the negotiation failure path does not reset or harden the security state. The transport restriction that should have blocked RDSTLS is effectively bypassed, allowing an attacker to reach the pre-authentication RDSTLS stage. This is a logic/state-machine flaw rather than a memory corruption bug: the attacker manipulates negotiation ordering to arrive at a state the administrator explicitly forbade. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) confirms a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and scope change, consistent with an attacker gaining access to a security context outside the intended transport policy.

No public PoC, exploit code, or Nuclei template is available, and the sparse description does not expose specific function names, packet field names, or endpoint paths. The attack chain in the next section is therefore described at the protocol-negotiation level, consistent with the vulnerability class, and not with fabricated implementation details.

Exploitation Scenarios

The following chain is inferred from the NVD description and the RDP protocol behavior it describes. No public exploit exists; no specific function, packet field, or endpoint names are asserted beyond those in the description.

1. Reconnaissance / target identification. An attacker scans for hosts exposing the FreeRDP RDP server (commonly TCP/3389). Identification can be done with service fingerprinting (for example, Shodan dorks such as product:"FreeRDP" or port:3389) and by probing the negotiation behavior of the listener. The attacker needs only network reachability to the RDP port.

2. Triggering the bypass. The attacker initiates an RDP connection and sends protocol negotiation requests that are deliberately incompatible with the server's advertised or configured capabilities. The server responds with a negotiation failure. Critically, the server does not terminate the session or permanently lock the transport state; the security policy enforcement point is skipped on this error path.

3. Entering RDSTLS. After the negotiation failure, the attacker completes a TLS handshake with the server and proceeds into RDSTLS. The server, whose policy should have rejected RDSTLS outright, accepts the RDSTLS connection because the earlier negotiation failure left the transport restriction unenforced.

4. Post-exploitation impact. The attacker now holds an RDSTLS pre-authentication channel that policy intended to forbid. From this position the attacker can interact with the RDP authentication surface that RDSTLS exposes—enabling credential attacks, authentication bypass attempts, session manipulation, or use of RDSTLS as a foothold for further protocol abuse. CVSS rates confidentiality impact as High; whether the attacker can convert the bypass into full session compromise or code execution depends on downstream server configuration and authentication handling, which is not specified in the available data.

Because no PoC is public, defenders should assume the logical bypass may be reproduced with modest protocol fuzzing effort and prioritize patching.

Impact Assessment

• Business impact: Any internet- or network-exposed FreeRDP server with RDSTLS disabled is potentially reachable through a transport policy the administrator believed was enforced. This undermines the security boundary that protects the pre-authentication stage, increases risk of credential compromise and unauthorized remote desktop access, and may violate compliance requirements for remote access controls.
• Affected systems: FreeRDP server deployments before 3.31.0 that expose RDP to untrusted networks. The supplied affected-version data is empty, but the NVD description states "before 3.31.0" as the vulnerable range.
• Blast radius: CVSS scope is Changed (S:C), meaning exploitation can affect resources beyond the vulnerable component's security authority—here, the transport security context and any downstream authentication/session material. Confidentiality is High (C:H), Integrity is Low (I:L), and Availability is None (A:N).
• Attacker prerequisites: None. AV:N/AC:L/PR:N/UI:N—network reachable, low complexity, no privileges, no user interaction.
• Exploitability: Base score 9.3. EPSS has not yet scored this CVE; do not assume a low likelihood based on the absence of a public PoC. CISA KEV status: not listed.

Detection Guidance

The following signatures are behavioral and protocol-oriented because no public PoC or exact packet signatures are available. Tune thresholds to your environment; treat RDSTLS negotiation attempts on servers where RDSTLS is disabled as high-signal events.

Sigma Rule

title: FreeRDP RDSTLS Negotiation Bypass Attempt (CVE-2026-91949)
id: 3f0b2c7e-9a4d-4c1e-b8f2-7d5a1e9c2b64
status: experimental
description: Detects negotiation-failure followed by TLS handshake and RDSTLS entry against FreeRDP servers that disable RDSTLS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91949
author: valtersit.com
date: 2026/01/01
logsource:
  product: freerdp
  service: rdp
detection:
  selection_negotiation_failure:
    event: protocol_negotiation
    outcome: failure
  selection_rdstls:
    transport_security|contains: 'RDSTLS'
  condition: selection_negotiation_failure and selection_rdstls
falsepositives:
  - Legitimate clients negotiating down when RDSTLS is enabled and expected
level: high
tags:
  - attack.t1190
  - cve.2026.91949

YARA Rule

rule CVE_2026_91949_FreeRDP_RDSTLS_Bypass
{
    meta:
        description = "Detects FreeRDP server builds prior to 3.31.0 associated with CVE-2026-91949 RDSTLS negotiation bypass"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91949"
        cve = "CVE-2026-91949"
    strings:
        $s1 = "RDSTLS" ascii wide
        $s2 = "RDSTLS_FEATURE" ascii wide
        $s3 = "FreeRDP" ascii wide
        $s4 = "freerdp" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        (2 of ($s1, $s2, $s3, $s4))
}

Suricata IDS Rule

alert tcp any any -> any 3389 (msg:"CVE-2026-91949 FreeRDP RDSTLS Negotiation Bypass Attempt"; flow:established,to_server; content:"|03 00|"; depth:2; content:"RDSTLS"; nocase; flowbits:set,rdstls_attempt; threshold: type both, track by_src, count 3, seconds 60; classtype:attempted-admin; reference:cve,2026-91949; sid:202691949; rev:1;)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=60s
  [network where destination.port == 3389 and network.transport == "tcp" and
     rdp.negotiation.outcome == "failure"]
  [network where destination.port == 3389 and network.transport == "tcp" and
     rdp.security.transport == "RDSTLS"]

Splunk SPL Query

index=rdp sourcetype=freerdp:server (event=negotiation outcome=failure) OR (transport="RDSTLS")
| transaction client_ip server_ip maxspan=60s
| search (event=negotiation AND outcome=failure) AND transport="RDSTLS"
| table _time client_ip server_ip event outcome transport

Wazuh OSSEC Rule

<group name="freerdp,rdp,cve-2026-91949">
  <rule id="100919" level="12">
    <decoded_as>json</decoded_as>
    <field name="event">negotiation_failure</field>
    <description>CVE-2026-91949: FreeRDP protocol negotiation failure observed (possible RDSTLS bypass attempt).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100920" level="14">
    <if_sid>100919</if_sid>
    <field name="transport">RDSTLS</field>
    <description>CVE-2026-91949: RDSTLS connection established after negotiation failure - active exploitation suspected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — fix confirmed by two independent sources: OSV and Debian advisories).

1. Immediate mitigations

   • Where patching is not immediately possible, restrict network access to FreeRDP server listeners (TCP/3389) to trusted management networks, VPN, or jump hosts; do not expose FreeRDP servers directly to the internet.
   • Enforce NLA/strong authentication at the perimeter and monitor for repeated negotiation-failure-then-TLS/RDSTLS sequences from the same source.
   • Alert on any RDSTLS negotiation where server policy disables RDSTLS—this condition should never legitimately occur.

2. Patch / upgrade

   • Upgrade FreeRDP server to version 3.31.0 or later. This is the confirmed fixed release referenced by the OSV and Debian advisories.
   • Track distributions: Debian and OSV package entries confirm availability of fixed builds; apply vendor/package-manager updates (e.g., apt-get update && apt-get install --only-upgrade freerdp*) and verify the running server reports 3.31.0+.
   • After upgrading, re-test that RDSTLS remains disabled by policy and that negotiation-failure paths terminate the session rather than allowing RDSTLS entry.

3. Long-term hardening

   • Treat RDP/FreeRDP listeners as tier-0 infrastructure: network segmentation, MFA-gated NLA, and least-privilege session policies.
   • Add regression tests to CI that assert transport policy enforcement on negotiation-failure paths (protection mechanisms must fail closed, per CWE-693).
   • Continuously monitor CVEs for FreeRDP and subscribe to vendor/OSV/Debian advisories for early patching.
   • Log and retain RDP negotiation telemetry to support post-incident forensics of pre-auth bypass attempts.

References

• NVD — CVE-2026-91949: https://nvd.nist.gov/vuln/detail/CVE-2026-91949
• OSV — FreeRDP advisory / package entry (fixed in 3.31.0): https://osv.dev/vulnerability/CVE-2026-91949
• Debian Security Tracker — freerdp2/freerdp3: https://security-tracker.debian.org/tracker/CVE-2026-91949
• CWE-693 — Protection Mechanism Failure: https://cwe.mitre.org/data/definitions/693.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / exploit-in-the-wild note: No public PoC, exploit code, or Nuclei template is available for CVE-2026-91949 as of this report. CISA KEV status is NO. EPSS has not yet scored this vulnerability. No known threat actor campaigns are attributed in the available data. Treat any observed negotiation-failure-then-RDSTLS sequence as a potential live exploitation attempt and investigate accordingly.