{"id":"CVE-2026-114047","kind":"vulnerability","aliases":["CVE-2026-114047"],"related":[],"title":"FreeRDP: proxy accepts untrusted target certificates, enabling interception of sessions","description":"FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS certificates when no verification module is configured. Network-positioned attackers can intercept the proxy's outbound connection and present a self-signed, wrong-hostname certificate to impersonate the RDP target and receive proxied session data.","summary":"FreeRDP's proxy accepts any target TLS certificate when no verification module is configured. A network attacker who intercepts the proxy's outbound connection can impersonate the RDP target and receive the proxied session data.","severity":"high","cvss":7.6,"epss":0.00159,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freerdp","linux","other","rdp","self-hosted"],"not_affected_if":["not-using-proxy","version-3.32.0-or-later"],"how_to_check":"- Check the FreeRDP version with `xfreerdp --version` or the packaged version of FreeRDP (proxy component) on hosts that run the FreeRDP proxy.\n- Check whether a proxy certificate verification module is configured in the proxy setup; the sources do not name the configuration key, so unknown.","fix":"- Upgrade FreeRDP to `3.32.0` or later.\n- Configure a certificate verification module for the proxy until the upgrade is applied, per the vendor's guidance (exact setting unknown from the sources).","status":"open","published_at":"2026-10-21T01:17:27+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:14:26+00:00","updated_at":"2026-10-25T03:14:26+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:14:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FreeRDP to `3.32.0` or later.\n- Configure a certificate verification module for the proxy until the upgrade is applied, per the vendor's guidance (exact setting unknown from the sources).","reach":"network","title":"FreeRDP: proxy accepts untrusted target certificates, enabling interception of sessions","impact":"medium","summary":"FreeRDP's proxy accepts any target TLS certificate when no verification module is configured. A network attacker who intercepts the proxy's outbound connection can impersonate the RDP target and receive the proxied session data.","category":"other","nicknames":[],"who_cares":["freerdp","rdp","self-hosted","linux"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads proxied RDP session data by impersonating the target","analyst_note":"Confirm the exact verification-module configuration setting and the affected proxy components in the NVD entry and FreeRDP release notes for 3.32.0.","how_to_check":"- Check the FreeRDP version with `xfreerdp --version` or the packaged version of FreeRDP (proxy component) on hosts that run the FreeRDP proxy.\n- Check whether a proxy certificate verification module is configured in the proxy setup; the sources do not name the configuration key, so unknown.","needs_analyst":true,"not_affected_if":["not-using-proxy","version-3.32.0-or-later"],"who_is_affected":"Teams running the FreeRDP proxy between clients and RDP targets from version 2.0.0 up to but not including 3.32.0 are exposed, especially where no verification module is configured. The risk depends on an attacker being positioned on the network path between the proxy and the RDP target. Teams not using the FreeRDP proxy, or running 3.32.0 or later, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":3392,"output_tokens":663,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114047':13A,16A '-2026':12A,15A '2.0.0':61C '3.32.0':63C 'accept':3A,27B,74C 'attack':40B,88C 'certif':6A,31B,67C,78C,105C 'configur':37B,84C 'connect':47B,95C 'contain':64C 'cve':11A,14A 'data':58B,115C 'enabl':7A 'freerdp':1A,17B,24B,59C 'host':23B 'hostnam':104C 'imperson':49B,107C 'improp':66C 'intercept':8A,42B,90C 'linux':18B 'modul':35B,82C 'network':39B,86C 'network-posit':85C 'outbound':46B,94C 'posit':87C 'present':97C 'proxi':2A,26B,44B,56B,72C,92C,113C 'rdp':20B,51B,109C 'receiv':54B,112C 'self':22B,100C 'self-host':21B 'self-sign':99C 'session':10A,57B,114C 'sign':101C 'target':5A,29B,52B,76C,110C 'tls':30B,77C 'untrust':4A,75C 'valid':68C 'verif':34B,81C 'vulner':69C 'wrong':103C 'wrong-hostnam':102C","nicknames":[],"mitigations":[],"who_affected":"Teams running the FreeRDP proxy between clients and RDP targets from version 2.0.0 up to but not including 3.32.0 are exposed, especially where no verification module is configured. The risk depends on an attacker being positioned on the network path between the proxy and the RDP target. Teams not using the FreeRDP proxy, or running 3.32.0 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114047","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114047","severity":null,"published_at":"2026-10-21T01:17:27+00:00","modified_at":"2026-10-22T19:17:36+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114047","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114047","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}