FreeRDP RDSTLS Protocol Negotiation Bypass

Technical Analysis

CVE-2026-91949 exploits a flaw in FreeRDP's protocol negotiation logic where a server configured to reject RDSTLS connections can still be coerced into accepting them. The attacker initiates negotiation with an intentionally incompatible protocol request, observes the resulting failure response, then proceeds to complete a standard TLS handshake before pivoting into RDSTLS mode, bypassing the intended pre-authentication transport restriction. This is a logic flaw in state handling rather than a memory-corruption bug, making it exploitable pre-authentication with no special privileges required, and rated 9.3 CVSS due to its network-reachable, low-complexity nature. Because FreeRDP is commonly embedded in remote-access tooling, CI/CD jump hosts, and virtualized development environments, any host that exposes RDP-based access to AI agent orchestration servers, model training infrastructure, or agent tool-execution sandboxes could be remotely accessed by unauthorized parties, potentially leading to theft of API keys, model weights, or manipulation of agent runtime environments.

Affected Systems

FreeRDP server implementations version prior to 3.31.0, including deployments embedded in third-party remote desktop products, virtualization platforms, and Linux/Windows RDP gateway solutions using the FreeRDP library.

Indicators of Compromise

• No confirmed public IOCs available at time of disclosure; monitor for anomalous RDSTLS session establishment following failed protocol negotiation attempts in RDP server logs.

Remediation Steps

1. 1

   Upgrade FreeRDP

   Update all FreeRDP server instances to version 3.31.0 or later where the negotiation bypass has been patched.

2. 2

   Restrict Network Exposure

   Limit RDP server exposure to trusted networks via firewall rules or VPN, and disable direct internet-facing RDP access where possible.

3. 3

   Audit Protocol Configuration

   Review server configuration to confirm RDSTLS and other legacy protocols are fully disabled at the network layer, not solely via application-level policy.

4. 4

   Enable Enhanced Logging

   Enable verbose RDP negotiation logging to detect repeated failed negotiation attempts followed by successful RDSTLS handshakes.

5. 5

   Segment Agent Infrastructure

   Ensure any hosts running AI agent frameworks, orchestration tools, or credential stores are not reachable via vulnerable RDP servers, and rotate any credentials/API keys potentially exposed through affected jump hosts.