Critical FreeRDP Flaw Allows Header Injection

FreeRDP versions up to and including 3.28.0 contain a critical vulnerability, tracked as CVE-2026-67289, that fails to validate input within the RDP redirection TargetNetAddress field. This flaw allows a malicious or compromised RDP server to inject arbitrary headers into HTTP proxy CONNECT requests when a client connects through a proxy.

With a CVSS score of 9.8, this vulnerability is classified as critical. It poses a significant risk to any environment where FreeRDP is utilized to facilitate RDP connections through an HTTP proxy, as it allows for the manipulation of outgoing network traffic at the application layer.

What's at Risk

The vulnerability affects all FreeRDP versions prior to 3.29.0. Organizations that deploy FreeRDP clients in environments relying on HTTP proxy infrastructure for remote access are at the highest risk.

Systems that are internet-facing or those that frequently connect to untrusted or external RDP servers are particularly exposed. Because the flaw involves the manipulation of proxy request lines and host headers, any environment utilizing automated or proxied RDP connections should be considered vulnerable until the software is updated.

How the Flaw Works

This vulnerability is a form of HTTP Request Injection. When an application accepts user-controlled input and inserts it directly into an HTTP request without proper sanitization or encoding, it can lead to unexpected behavior in downstream network components.

In a general sense, vulnerabilities of this class allow an attacker to alter the structure of an HTTP request. By injecting characters like carriage returns and line feeds (CRLF), an attacker can terminate the intended request prematurely and start a new one, or append unauthorized headers. This can be used to bypass security controls, perform unauthorized actions on behalf of the proxy, or manipulate the routing of the connection to intercept or redirect sensitive data.

How to Protect Your Systems

• Upgrade immediately to FreeRDP version 3.29.0 or newer to receive the necessary input validation patches.
• Audit network configurations to identify systems currently using HTTP proxies for RDP traffic and prioritize these for patching.
• Restrict outbound access from RDP clients to known, trusted server endpoints to minimize the risk of connecting to malicious servers.
• Monitor proxy logs for anomalous request patterns or headers that deviate from standard RDP connection behavior.
• Implement strict network segmentation to limit the potential blast radius if an RDP client is compromised via a malicious server.

Given the critical severity of this flaw, administrators should not delay the deployment of the vendor-provided patch. Unpatched clients remain susceptible to request injection attacks, which could be leveraged to subvert proxy security policies and compromise the integrity of network communications.