CVE-2026-42218: XRDP is vulnerable to a server timing attack, leading to user enumeration

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-20 · updated 2026-10-24
Weakness: CWE-204

Description

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure via username enumeration. This issue has been fixed in version 0.10.6.1.

Affected products

neutrinolabs xrdp: before 0.10.6.1 — fixed in 0.10.6.1

How to fix

Upgrade to a fixed version: neutrinolabs xrdp 0.10.6.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-42218 or the next vulnerability affects your stack