CVE-2026-114047

A flaw was found in FreeRDP. The FreeRDP proxy accepts untrusted target TLS certificates when no verification module is configured. A network-positioned attacker who can intercept the proxy's outbound connection can present a self-signed or wrong-hostname certificate to impersonate the RDP target and receive proxied session data. This issue affects FreeRDP from 2.0.0 before 3.32.0.

This issue is rated Moderate because exploitation requires a network man-in-the-middle position on the path between freerdp-proxy and the configured RDP target, and a user must initiate a proxied session (UI:R). Attack complexity is High because the attacker must intercept or redirect the proxy's outbound TLS connection and successfully present an accepted certificate when no rejecting verification module is configured. Successful exploitation can fully compromise confidentiality and integrity of the proxied RDP session, but availability impact is not demonstrated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict freerdp-proxy outbound connectivity to trusted RDP targets and trusted networks only. Configure an explicit TLS certificate verification module for the proxy's target connection and fail closed when verification is unavailable. If freerdp-proxy is unused, remove or disable the freerdp-server/proxy packages.