External risk intelligence

FreeRDP TLS Certificate EKU Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-67294

The vulnerability exists in the client-side TLS certificate validation logic of FreeRDP. Since this is a client-side component used to connect to servers rather than a listening service or network-accessible management interface, it is not typically exposed to the public internet in a way that allows for unsolicited remote exploitation.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security flaw in FreeRDP, a technology used for remote desktop connections. The issue involves how it validates digital certificates, potentially allowing a malicious actor to impersonate a legitimate server by using a certificate that is only meant for client authentication. At a high level, this could undermine the trust in remote connections if exploited.

Flaw in remote connection certificate validation.
Ensures trusted remote access, business continuity.
Confirm relevance and exposure of this technology.

Attack Path

How an attacker could exploit the issue

An attacker could trick a FreeRDP client into connecting to a malicious server by presenting a certificate that is only valid for client authentication. The FreeRDP client, when validating the server's certificate, improperly accepts a certificate that is not intended for server use. This could allow an attacker to impersonate an RDP server and potentially intercept or manipulate the RDP session.

Attacker must control a server.
Client accepts improper server certificate.
Potential for session interception.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a malicious server to impersonate a legitimate RDP server when a FreeRDP client connects. This might occur when the client is configured to trust a Certificate Authority (CA) that can issue certificates with the client authentication Extended Key Usage (EKU) but not server authentication EKU.

Server certificate validation may be bypassed.
Malicious server could impersonate legitimate server.
Unauthorized access to client session data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in FreeRDP's TLS certificate validation impacts the security of client connections. Teams responsible for endpoint security, software deployment, and potentially application owners using FreeRDP as a component need to coordinate. The immediate priority is to identify all instances of FreeRDP, determine their exposure, and assess their criticality to plan remediation, which may involve coordinating with vendors or planning maintenance windows for updates.

Own the FreeRDP client-side vulnerability.
Verify FreeRDP usage and exposure.
Plan and coordinate updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FreeRDP and how is it used?

FreeRDP is a free, open-source software implementation of the Remote Desktop Protocol (RDP). It is widely used by developers and system administrators to create client applications that allow users to connect to remote computers and servers over a network, providing a consistent way to interact with graphical desktop environments across different operating systems.

How does CWE-295 relate to CVE-2026-67294?

CVE-2026-67294 is a flaw in certificate validation, categorized under CWE-295 (Improper Certificate Validation). In plain terms, the software fails to properly check the 'Extended Key Usage' on a server's digital certificate. Instead of rejecting a certificate intended only for client identification, the system mistakenly accepts it as valid for a server connection, weakening the secure identity verification required for TLS.

When does this vulnerability trigger?

The vulnerability occurs when a FreeRDP client attempts to connect to a malicious server that presents a certificate specifically issued only for client authentication. The bug is not triggered by standard, correctly configured server certificates. It only manifests if the client trusts a Certificate Authority that permits this specific type of certificate mismatch to bypass intended security checks.

Is my system at risk if I use FreeRDP?

According to Halo Surface Signal, this issue resides in the client-side code, not a listening service. Because FreeRDP clients are used to reach out to servers rather than waiting for incoming connections, the software is generally not exposed to the public internet in a way that allows for unsolicited remote attacks. Risk depends on whether your client connects to untrusted or compromised environments.

What should I do to secure my FreeRDP usage?

The first step is to inventory all systems running FreeRDP within your environment to understand where it is utilized. Once identified, prioritize these systems for maintenance. Coordinate with your IT or security team to plan an update to a version beyond 3.29.0, where this validation logic is corrected. Keep your software patched to ensure that certificate checks perform as expected.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.