A critical flaw in FreeRDP versions up to and including 3.28.0 lets a malicious RDP server inject arbitrary requests and headers into a client's HTTP proxy CONNECT traffic via unfiltered control characters in a redirection field.
What Is It
CVE-2026-67289 is an HTTP request/response splitting issue (CWE-113) in FreeRDP. The client does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. That value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering.
A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters, injecting arbitrary headers or entire requests into the HTTP proxy CONNECT request.
Why It Matters
VulnCheck rates this CVSS 3.1 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low complexity, no privileges and no user interaction required, with high confidentiality, integrity, and availability impact. The CVSS 4.0 score is 9.3 (CRITICAL).
The attack originates from the RDP server side, so any client that can be induced to connect to (or be redirected toward) an attacker-controlled server through an HTTP proxy is in scope. The supplied source material contains no CISA KEV entry for this CVE, so there is no confirmation of active exploitation at this time.
What's Vulnerable
- Vendor/Product: FreeRDP
- Affected: all versions below 3.29.0 (explicitly, <= 3.28.0)
- Not affected: 3.29.0 and later
- Precondition for exploitation: the client connects through an HTTP proxy
Patch Status
Fixed in FreeRDP 3.29.0. Upgrade any FreeRDP client at 3.28.0 or earlier to 3.29.0 or later. The fix is published in commit f3b4347105114fe7453828736bea069999af319f and documented in GitHub Security Advisory GHSA-mwwh-mhp9-q7vm. No CISA KEV remediation deadline or required action was supplied for this CVE.
Sources
- NVD, CVE-2026-67289 (published 2026-08-01, source
[email protected]) - FreeRDP GitHub Security Advisory GHSA-mwwh-mhp9-q7vm; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mwwh-mhp9-q7vm
- FreeRDP fix commit; https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f
- VulnCheck Advisory; https://www.vulncheck.com/advisories/freerdp-before-http-proxy-request-injection-via-redirection