Каталог CVE

CVE-2026-55626

xrdp is an open source RDP server. In versions 0.10.6…

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active desktop sessions of other users on the same system. Users using other backends, such as xorgxrdp or Xvnc over TCP sockets, are not affected. This issue has been fixed in version 0.10.6.1.

Критичність: High · CVSS 8CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Published: Jul 20, 2026, 5:11:44 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.19% · Oct 27, 2026

Projects and upstream resources

[xrdp][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	xrdp	`0.10.6.1-2`	FixedDistribution-reported fixed boundary	[CVE-2026-55626]
Debiansid	xrdp	`0.10.6.1-3`	Fixed	[CVE-2026-55626]
Debianforky	xrdp	`0.10.6.1-2`	FixedDistribution-reported fixed boundary	[CVE-2026-55626]
Debianforky	xrdp	`0.10.6.1-3`	Fixed	[CVE-2026-55626]

Showing 4 fix observations. All 11 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	xrdp	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	xrdp	Not reported	Not affectedDistribution reports not affected	[CVE-2026-55626]
Debianbookworm	xrdp	`0.9.21.1-1+deb12u2`	Not affected	[CVE-2026-55626]
Debianbookworm-security	xrdp	`0.9.21.1-1+deb12u3`	Not affected	[CVE-2026-55626]
Debianforky	xrdp	`0.10.6.1-2`	FixedDistribution-reported fixed boundary	[CVE-2026-55626]
Debianforky	xrdp	`0.10.6.1-3`	Fixed	[CVE-2026-55626]
Debiansid	xrdp	`0.10.6.1-2`	FixedDistribution-reported fixed boundary	[CVE-2026-55626]
Debiansid	xrdp	`0.10.6.1-3`	Fixed	[CVE-2026-55626]
Debiantrixie	xrdp	Not reported	Not affectedDistribution reports not affected	[CVE-2026-55626]
Debiantrixie	xrdp	`0.10.1-3.1+deb13u2`	Not affected	[CVE-2026-55626]
Debiantrixie-security	xrdp	`0.10.1-3.1+deb13u2`	Not affected	[CVE-2026-55626]

Original provider fields

{
  "package_releases": [
    {
      "name": "xrdp",
      "status": "fixed",
      "release": "sid",
      "version": "0.10.6.1-3"
    },
    {
      "name": "xrdp",
      "status": "fixed",
      "release": "forky",
      "version": "0.10.6.1-3"
    },
    {
      "name": "xrdp",
      "status": "not affected",
      "release": "trixie",
      "version": "0.10.1-3.1+deb13u2"
    },
    {
      "name": "xrdp",
      "status": "not affected",
      "release": "trixie-security",
      "version": "0.10.1-3.1+deb13u2"
    },
    {
      "name": "xrdp",
      "status": "not affected",
      "release": "bookworm",
      "version": "0.9.21.1-1+deb12u2"
    },
    {
      "name": "xrdp",
      "status": "not affected",
      "release": "bookworm-security",
      "version": "0.9.21.1-1+deb12u3"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "xrdp",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "0.10.6.1-2"
    },
    {
      "bug": null,
      "name": "xrdp",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "0.10.6.1-2"
    },
    {
      "bug": null,
      "name": "xrdp",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "xrdp",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "xrdp",
      "fixed_version": "0",
      "applicability_unknown": true
    },
    {
      "name": "xrdp",
      "ranges": [
        {
          "fixed": "0.10.6.1",
          "introduced": "0.10.3",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55626",
      "fixed_version": "0.10.6.1",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-55626",
      "provider_updated_at": "2026-10-24T20:10:00.137"
    }
  ]
}

OpenFactory catalog packages

Зіставлення пакетів триває.

[Debian 12 (Bookworm)]

[xrdp]Невідомо
Подробиці (6)
- 0.9.21.1-1+deb12u2 · amd64 · bookworm
  Не уражена
  nvd · xrdp · debian · bookworm
- 0.9.21.1-1+deb12u2 · arm64 · bookworm
  Не уражена
  nvd · xrdp · debian · bookworm
- 0.9.24-5~bpo12+1 · amd64 · bookworm-backports
  Не уражена
  nvd · xrdp · debian · bookworm
- 0.9.24-5~bpo12+1 · arm64 · bookworm-backports
  Не уражена
  nvd · xrdp · debian · bookworm
- 0.9.21.1-1+deb12u3 · amd64 · bookworm-security
  Не уражена
  nvd · xrdp · debian · bookworm
- 0.9.21.1-1+deb12u3 · arm64 · bookworm-security
  Не уражена
  nvd · xrdp · debian · bookworm

Спостережено: Oct 27, 2026, 7:12:48 AM UTC

Посилання

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]