What’s Vulnerable › Vulnerabilities

CVE-2026-67294: FreeRDP before 3.29.0 TLS Certificate EKU Bypass

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-01 · updated 2026-09-11
• Weakness: CWE-295

Description

FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. In x509_utils_verify(), when server-purpose (X509_PURPOSE_SSL_SERVER) verification fails, the code falls back to client-purpose and any-purpose verification, so a trusted, hostname-matching certificate valid only for clientAuth can be accepted as the RDP server certificate. In environments relying on EKU separation between client and server certificates, this allows a clientAuth-only certificate issued by a trusted CA to bypass server certificate purpose validation.

Affected products

• FreeRDP: before 3.29.0 — fixed in 3.29.0

How to fix

Upgrade to a fixed version: FreeRDP 3.29.0. Check the vendor advisory for mitigations.

References

• https://github.com/FreeRDP/FreeRDP/commit/f3b4347105114fe7453828736bea069999af319f
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-89c6-jjrw-96h4
• https://www.vulncheck.com/advisories/freerdp-before-tls-certificate-eku-bypass
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-89c6-jjrw-96h4

Get alerted when CVE-2026-67294 or the next vulnerability affects your stack