CVE-2026-67289

A flaw was found in FreeRDP. A malicious or compromised Remote Desktop Protocol (RDP) server can exploit this vulnerability to inject arbitrary headers or requests into an HTTP proxy CONNECT request. This occurs because FreeRDP does not properly validate control characters in the server-controlled RDP redirection TargetNetAddress field, which is then used without filtering. This injection could allow an attacker to manipulate the proxy's behavior or bypass certain network security policies.

Moderate: This client-side vulnerability in FreeRDP allows for HTTP proxy request injection. Exploitation requires a FreeRDP client to be configured to use an HTTP proxy and to connect to a malicious or compromised RDP server, which then sends a crafted redirection PDU. This limits the attack surface to specific client configurations and interactions with untrusted RDP endpoints.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, FreeRDP clients should avoid connecting to untrusted RDP servers when configured to use an HTTP proxy. Alternatively, if connecting to potentially untrusted RDP servers, disable the HTTP proxy configuration for FreeRDP.