Red Hat FreeRDP Update Fixes Critical CVE-2026-91949 on RHEL 10
Tech GuruQuick Answer
CVE-2026-91949 concerns a FreeRDP server-side transport-policy bypass. Red Hat excludes systems used only for outbound client connections from this server-side attack. RHSA-2026:73979 supplies freerdp 2:3.10.3-12.el10_2.13 for RHEL 10.2 AppStream. Establish the runtime role, update the matching package, and verify server transport policy and dependent sessions.
Confirm Scope And Apply The Supported Fix
What to do now: Distinguish FreeRDP server deployments from outbound-only clients, confirm Red Hat's applicable package fix, and test the server's permitted and prohibited transport behavior after updating. Preserve the package and recovery records.
Evidence status, 2026-10-02 UTC: Red Hat's CVE record and structured erratum (CSAF) confirm the impact and fixed RPM mapping below. Package rollout and regression tests have not been performed here. Confirm your repository and subscription before deployment.
Scope And Authority
| Product scope | FreeRDP on RHEL 10.2 |
|---|---|
| Advisory | RHSA-2026:73979 |
| CVE | CVE-2026-91949 |
| Authoritative release date | 2026-10-02 14:18:22 UTC |
| Authority revision date | CSAF last-updated entry: 2026-10-02 14:18:22 UTC; document generated 17:36:28 UTC. These are source-tracking timestamps, not installation or test dates. |
| Affected versions | RHEL 10.2 AppStream packages covered by this erratum; compare the installed RPM, including epoch and architecture, with the fixed mapping. Do not transfer this build to another stream. |
| Fixed version | freerdp 2:3.10.3-12.el10_2.13 in RHEL 10.2 AppStream; the prefix before the colon is the RPM epoch. |
| CVSS base score | 9.3 (official CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | This notice has no verified exploitation statement for this erratum. Do not infer either exploitation or its absence from the score. |
What Changed
Red Hat's CVE record describes a FreeRDP server flaw that can allow an unauthenticated peer to establish Remote Desktop Services over TLS (RDSTLS) connections despite a policy disabling that transport. The affected boundary is pre-authentication transport policy; this description does not establish a bypass of every login control. Red Hat explicitly says the server-side flaw cannot be exploited against systems used only for outbound FreeRDP client connections.
What To Validate Now
- Inventory. Record the RHEL release, FreeRDP package build, architecture, repository, and owner. Identify whether FreeRDP provides a server endpoint or is used only for outbound client connections.
- Establish applicability. Use Red Hat's server-versus-client distinction to assess the exploit path, then confirm the package and RHEL branch in RHSA-2026:73979. Do not infer package-fix status solely from the runtime role.
- Remediate. Install freerdp 2:3.10.3-12.el10_2.13 or its supported superseding update from the matching RHEL 10.2 AppStream repository. Include epoch 2 when comparing RPM versions. This notice does not establish a live-patch or container-image fix.
- Validate. Record the resulting package build and restart affected workloads where required. In an authorized test environment, check that permitted sessions still work and disabled transports remain unavailable; also test disconnect and recovery behavior. These are proposed acceptance checks, not a performed exploit test or a supplied command sequence.
Operational Cautions
Confirm subscription access, branch support, and package compatibility before deployment. Preserve prior packages and recovery records. A rollback may restore vulnerable software and is not a security fix. Container deployments need their own verified image and package mapping; no image digest or live-patch procedure is established here. Severity alone does not prove exploitation.
Evidence To Retain
- Asset and owner identifiers, exact product and release, architecture or platform, relevant configuration, and the applicability decision.
- UTC timestamps and vendor advisory revision, change approval, before-and-after versions, and installer or package-manager output.
- Relevant logs, validation results, exceptions, compensating controls, and recovery or rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
