CVE-2026-55626: xrdp Xvnc backend authentication issue on RHEL 9

CVE-2026-55626 is a missing-authentication flaw in xrdp's Xvnc-over-UNIX-domain-socket (Xvnc-UDS) session backend. xrdp deliberately starts Xvnc with RFB SecurityTypes None because access to the intended UNIX socket is controlled by filesystem permissions. Before the fix, however, xrdp did not disable Xvnc's separate TCP RFB listener. Consequently, the same desktop was also reachable on localhost TCP port 5900 + display without any RFB credentials. A local peer able to reach that loopback listener could connect directly and view or control another user's active desktop, bypassing xrdp's intended per-session authorization boundary.

• Affected package/component: xrdp, specifically sesman/sesexec/session.c in the Xvnc-UDS session-start path, together with a TigerVNC-compatible Xvnc backend.
• Affected upstream versions: xrdp 0.10.3 through 0.10.6. The release-line parent tested here, ee84a41c7d76f651bea45b89303d56d894a2f057, is after the v0.10.6 tag and immediately before the security fix.
• Fixed version: xrdp 0.10.6.1.
• Risk: High. A local authenticated or otherwise local network peer can bypass the intended UNIX-socket access control and obtain an unauthenticated RFB session to another user's desktop. Successful access permits desktop confidentiality and integrity compromise and may disrupt the session.
• Scope clarification: The vulnerable unintended peer is Xvnc's loopback TCP listener. Xvnc's intended UNIX-domain socket remains permission-controlled. Normal Xvnc-over-TCP mode and xorgxrdp are not this bug.

Impact Parity

• Disclosed/claimed maximum impact: Authentication/authorization bypass allowing unauthorized viewing or control of active desktop sessions.
• Reproduced impact: An unauthenticated RFB 3.8 peer connected over real TCP to each vulnerable Xvnc process, selected security type None (1), received a successful security result, and reached ServerInit for the live 320x240 desktop without supplying a username, password, cookie, or other credential. The fixed build refused the same TCP connections.
• Parity: full.
• Not demonstrated: The proof stops at successful authenticated-session bypass and desktop initialization; it does not transmit framebuffer/input messages, steal user data, execute commands, escalate privileges, or claim Internet-remote reachability. Those stronger actions are unnecessary to establish the disclosed authorization bypass.

Root Cause

For an Xvnc-UDS session, prepare_xvnc_xserver_params() constructs the Xvnc command line. The vulnerable code adds:

-rfbunixpath <per-user socket>
-rfbunixmode 432
-SecurityTypes None

432 is decimal notation for mode 0660. The design assumes UNIX-socket ownership and permissions are the sole authorization mechanism, so disabling in-protocol RFB authentication is intentional for that socket. The mistake is that adding -rfbunixpath does not implicitly suppress Xvnc's default TCP listener. The generated command therefore exposes two transports sharing SecurityTypes None:

1. the intended permission-controlled UNIX socket; and
2. an unintended loopback TCP socket at 5900 + display, which has no filesystem authorization boundary.

The vulnerable runtime command captured in bundle/logs/vulnerable-attempt-1-processes.log lacks a TCP-disable option:

Xvnc :10 ... -rfbunixpath /tmp/cve55626-vulnerable/run/xrdp/1000/xrdp_display_10 -rfbunixmode 432 -SecurityTypes None ...

The fixed runtime command in bundle/logs/fixed-attempt-3-processes.log adds -rfbport -1:

Xvnc :10 ... -rfbport -1 -rfbunixpath /tmp/cve55626-fixed/run/xrdp/1000/xrdp_display_10 -rfbunixmode 432 -SecurityTypes None ...

The one-line upstream fix is commit 517b8a180d8cbad1b7950ff4f6b31491318f5bb5 on the v0.10 release line. It inserts "-rfbport", "-1" before -rfbunixpath, preventing creation of the unintended TCP listener. bundle/logs/security_patch.diff captures this exact change.

Reproduction Steps

1. Run bundle/repro/reproduction_steps.sh from any directory. It accepts PRUVA_ROOT and otherwise derives the bundle root from its own path.
2. The script reads bundle/project_cache_context.json, uses the prepared checkout when available, resolves the fixed commit and its exact parent, and verifies that only the fixed side contains the expected patch hunk.
3. It installs its clean-sandbox dependencies, builds and installs both exact xrdp revisions, and uses the real xrdp-sesman, xrdp-sesexec, xrdp-sesrun, and TigerVNC Xvnc programs.
4. It creates two isolated vulnerable Xvnc-UDS sessions and two isolated fixed sessions. Each session crosses xrdp's real session-start path before an RFB 3.8 client connects through a localhost TCP socket.
5. The client deliberately supplies no credentials. For vulnerable sessions, the script requires RFB security type None, a successful security result, and receipt of ServerInit. For fixed sessions, it requires the same TCP connection to fail closed.
6. The script writes bundle/repro/runtime_manifest.json on every attempt and exits 0 only when all two vulnerable attempts and both fixed controls satisfy their assertions.

Expected terminal result:

CONFIRMED: vulnerable xrdp Xvnc-UDS sessions exposed an unauthenticated RFB TCP peer; fixed commit disabled that TCP listener.

Evidence

• bundle/logs/reproduction_steps.log — complete latest run, including exact source identities and all four probe outcomes.
• bundle/logs/source_identity.log — vulnerable commit ee84a41c7d76f651bea45b89303d56d894a2f057 and fixed commit 517b8a180d8cbad1b7950ff4f6b31491318f5bb5.
• bundle/logs/security_patch.diff — one-line -rfbport -1 patch.
• bundle/logs/vulnerable-attempt-1-rfb.json and vulnerable-attempt-2-rfb.json — each records credentials_supplied: false, connected: true, security_types: [1], security_result: 0, and server_init_received: true.
• bundle/logs/fixed-attempt-3-rfb.json and fixed-attempt-4-rfb.json — each records credentials_supplied: false, connected: false, server_init_received: false, and ConnectionRefusedError.
• bundle/logs/vulnerable-attempt-{1,2}-processes.log — live vulnerable Xvnc command lines with -SecurityTypes None and no -rfbport -1.
• bundle/logs/fixed-attempt-{3,4}-processes.log — live fixed Xvnc command lines containing -rfbport -1.
• bundle/logs/*-session-launch.log and bundle/logs/*-sesman.log — product session-start diagnostics showing the xrdp path was exercised.
• bundle/repro/runtime_manifest.json — strict runtime manifest with entrypoint_kind: "tcp_peer", all reachability flags true, the runtime stack, and concrete proof paths.
• bundle/logs/repro_evidence_sha256.txt — SHA-256 inventory for the primary proof artifacts.

Latest vulnerable probe excerpt:

{
  "credentials_supplied": false,
  "connected": true,
  "none_security_offered": true,
  "security_types": [1],
  "security_result": 0,
  "server_init_received": true,
  "width": 320,
  "height": 240
}

Latest fixed negative-control excerpt:

{
  "credentials_supplied": false,
  "connected": false,
  "server_init_received": false,
  "error": "ConnectionRefusedError(111, 'Connection refused')"
}

The current worker is Ubuntu 26.04 rather than RHEL 9, but it runs the affected upstream xrdp code with a real TigerVNC Xvnc implementation supporting the same -rfbunixpath, -SecurityTypes None, and -rfbport -1 semantics used by the RHEL 9 deployment. No sanitizer or mocked parser/service was used.

Recommendations / Next Steps

1. Upgrade to xrdp 0.10.6.1 or later, or backport commit 517b8a180d8cbad1b7950ff4f6b31491318f5bb5.
2. Ensure every Xvnc-UDS launch explicitly disables TCP RFB with -rfbport -1; do not assume -localhost or -nolisten tcp disables the RFB listener (-nolisten tcp concerns the X11 transport).
3. As defense in depth, restrict local access to VNC/RFB ports and audit active Xvnc command lines/listening sockets for -SecurityTypes None combined with an enabled TCP RFB port.
4. Add an integration regression test that starts Xvnc-UDS, verifies the UNIX socket exists and remains usable by the authorized consumer, and asserts that 5900 + display refuses TCP connections.
5. Test both vulnerable-style and fixed-style behavior against the TigerVNC package shipped on supported RHEL 9 systems.

Additional Notes

• Idempotency: The final script completed successfully twice consecutively after clean per-attempt process and state cleanup. Each execution itself performs two vulnerable attempts and two fixed controls.
• Runtime boundary: The attack probe is a real RFB TCP peer, not a direct call to prepare_xvnc_xserver_params() or a reimplementation of Xvnc.
• Authentication boundary: xrdp authenticates/authorizes the session owner before starting the desktop. The bypass is subsequent direct access to that already-running desktop through Xvnc's unintended no-auth TCP listener.
• Attacker locality: Upstream describes a local attacker and -localhost binds the unintended listener to loopback. This confirms authorization bypass at a network-protocol TCP boundary, but does not establish access from an arbitrary remote host without an additional local foothold, tunnel, namespace route, or other localhost reachability mechanism.
• Display allocation: Display numbers can increase when prior X11 lock files remain; the script discovers the actual live display from the generated Xvnc command and probes its corresponding TCP port rather than relying on display :10.