CVE-2026-55626

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 5.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1	Product Release Notes
https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-m3xx-cpc4-982r	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) xrdp es un servidor RDP de código abierto. En las versiones 0.10.6 y anteriores, cuando se inicializa una sesión de usuario autenticado utilizando el backend Xvnc a través de sockets de dominio UNIX, el proceso Xvnc se inicia con mecanismos de autenticación insuficientes. Un atacante local autenticado podría explotar esta vulnerabilidad para eludir el aislamiento de sesión previsto, permitiéndole ver o controlar sin autorización las sesiones de escritorio activas de otros usuarios en el mismo sistema. Los usuarios que utilizan otros backends, como xorgxrdp o Xvnc a través de sockets TCP, no se ven afectados. Este problema ha sido solucionado en la versión 0.10.6.1.

Information

Published : 2026-07-20 18:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-55626

Mitre link : CVE-2026-55626

CVE.ORG link : CVE-2026-55626

JSON object : View

Products Affected

neutrinolabs

xrdp

CWE

CWE-287

Improper Authentication

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-55626", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55626", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-23T03:56:22.650232Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "neutrinolabs", "product": "xrdp", "versions": [{"status": "affected", "version": "< 0.10.6.1"}]}]}], "published": "2026-07-20T18:16:54.150", "references": [{"url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-m3xx-cpc4-982r", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1."}, {"lang": "es", "value": "xrdp es un servidor RDP de c\u00f3digo abierto. En las versiones 0.10.6 y anteriores, cuando se inicializa una sesi\u00f3n de usuario autenticado utilizando el backend Xvnc a trav\u00e9s de sockets de dominio UNIX, el proceso Xvnc se inicia con mecanismos de autenticaci\u00f3n insuficientes. Un atacante local autenticado podr\u00eda explotar esta vulnerabilidad para eludir el aislamiento de sesi\u00f3n previsto, permiti\u00e9ndole ver o controlar sin autorizaci\u00f3n las sesiones de escritorio activas de otros usuarios en el mismo sistema. Los usuarios que utilizan otros backends, como xorgxrdp o Xvnc a trav\u00e9s de sockets TCP, no se ven afectados. Este problema ha sido solucionado en la versi\u00f3n 0.10.6.1."}], "lastModified": "2026-10-24T20:10:00.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEE169D9-F247-47FE-AE5D-B78F40E73DC6", "versionEndExcluding": "0.10.6.1", "versionStartIncluding": "0.10.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}