CVE-2026-114047

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114047", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-20T21:41:06.180Z", "datePublished": "2026-10-21T00:36:25.525Z", "dateUpdated": "2026-10-22T18:18:48.176Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-21T00:36:25.525Z"}, "datePublic": "2026-10-05T00:00:00.000Z", "title": "FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation", "descriptions": [{"lang": "en", "value": "FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Certificate Validation", "cweId": "CWE-295", "type": "CWE"}]}], "affected": [{"vendor": "FreeRDP", "product": "FreeRDP", "defaultStatus": "unaffected", "versions": [{"version": "2.0.0", "status": "affected", "versionType": "semver", "lessThan": "3.32.0"}, {"version": "3.32.0", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "3.32.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjxv-5j98-cqx4", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-pjxv-5j98-cqx4)"}, {"name": "VulnCheck Advisory: FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-proxy-improper-tls-certificate-validation"}], "credits": [{"lang": "en", "value": "Kushalkhemka", "type": "finder"}, {"lang": "en", "value": "mayank-jangid-moon", "type": "finder"}, {"lang": "en", "value": "skigeek16", "type": "finder"}, {"lang": "en", "value": "opensec-intelligence", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-22T18:18:36.372748Z", "id": "CVE-2026-114047", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T18:18:48.176Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-114047", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-22T18:18:36.372748Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-22T18:18:41.644Z"}}], "cna": {"title": "FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation", "credits": [{"lang": "en", "type": "finder", "value": "Kushalkhemka"}, {"lang": "en", "type": "finder", "value": "mayank-jangid-moon"}, {"lang": "en", "type": "finder", "value": "skigeek16"}, {"lang": "en", "type": "finder", "value": "opensec-intelligence"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "FreeRDP", "product": "FreeRDP", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "3.32.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.32.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-05T00:00:00.000Z", "references": [{"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjxv-5j98-cqx4", "name": "GitHub Security Advisory (GHSA-pjxv-5j98-cqx4)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-proxy-improper-tls-certificate-validation", "name": "VulnCheck Advisory: FreeRDP 2.0.0 before 3.32.0 Proxy Improper TLS Certificate Validation", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "Improper Certificate Validation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.32.0", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-21T00:36:25.525Z"}}}, "cveMetadata": {"cveId": "CVE-2026-114047", "state": "PUBLISHED", "dateUpdated": "2026-10-22T18:18:48.176Z", "dateReserved": "2026-10-20T21:41:06.180Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-21T00:36:25.525Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FreeRDP", "vendor": "FreeRDP", "versions": [{"lessThan": "3.32.0", "status": "affected", "version": "2.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.32.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data."}], "id": "CVE-2026-114047", "lastModified": "2026-10-22T19:17:36.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114047", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-22T18:18:36.372748Z", "version": "2.0.3"}}]}, "published": "2026-10-21T01:17:27.230", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjxv-5j98-cqx4"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-proxy-improper-tls-certificate-validation"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "freerdp: FreeRDP: proxy improper TLS certificate validation allows target impersonation", "id": "2558040", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558040"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-295", "details": ["A flaw was found in FreeRDP. The FreeRDP proxy accepts untrusted target TLS certificates when no verification module is configured. A network-positioned attacker who can intercept the proxy's outbound connection can present a self-signed or wrong-hostname certificate to impersonate the RDP target and receive proxied session data. This issue affects FreeRDP from 2.0.0 before 3.32.0."], "mitigation": {"lang": "en:us", "value": "Restrict freerdp-proxy outbound connectivity to trusted RDP targets and trusted networks only. Configure an explicit TLS certificate verification module for the proxy's target connection and fail closed when verification is unavailable.\nIf freerdp-proxy is unused, remove or disable the freerdp-server/proxy packages."}, "name": "CVE-2026-114047", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "freerdp", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-21T00:36:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114047\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114047\nhttps://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjxv-5j98-cqx4\nhttps://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-proxy-improper-tls-certificate-validation"], "statement": "This issue is rated Moderate because exploitation requires a network man-in-the-middle position on the path between freerdp-proxy and the configured RDP target, and a user must initiate a proxied session (UI:R). Attack complexity is High because the attacker must intercept or redirect the proxy's outbound TLS connection and successfully present an accepted certificate when no rejecting verification module is configured. Successful exploitation can fully compromise confidentiality and integrity of the proxied RDP session, but availability impact is not demonstrated.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,3.32.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.32.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FreeRDP", "source": "cna", "vendor": "FreeRDP"}, "product": "freerdp", "vendor": "freerdp"}], "created": "2026-10-21T16:30:06.675997+00:00", "updated": "2026-10-22T12:15:05.750201+00:00", "vendors": ["freerdp", "freerdp$PRODUCT$freerdp"]}