marcpope/cortendesk v1.17.1

CortenDesk 1.17.1

on GitHub

1.17.1

A minor security package update: symfony/mime 8.1.10 fixes CVE-2026-45070. The blast radius is small, but better to be safe. Nothing else changed in this release, and there are no migrations.

If you're upgrading from 1.16.0 or earlier, everything since then is below, all in one place.

Everything in 1.17.0

RustDesk 1.5 WebRTC, end to end: the bundled ID server passes WebRTC signalling, strategies set the STUN and TURN servers, and the web client connects over WebRTC.

New

• WebRTC in the web client. To a device running RustDesk 1.5 or later, the web client offers WebRTC alongside the relay and goes straight to the device when it can. On a LAN that means machine to machine instead of a trip through the relay. The relay stays the fallback, as before. The session's Details panel shows the Transport: WebRTC direct, WebRTC through TURN, or Relay.
• WebRTC for desktop clients. The bundled server is now CortenDesk Server 1.2.0, which passes RustDesk 1.5's WebRTC offers, answers and candidates between devices. Stock rustdesk-server does not.
• Strategies set the ICE servers. A new Network group sets ice-servers, the STUN and TURN servers RustDesk 1.5 uses for WebRTC. The console refuses any entry the client would silently skip, such as a TURN server without credentials.
• Settings → Server: "Web client uses WebRTC" (on by default) and "Web client ICE servers".
• Wiki: a new WebRTC connections page covers requirements, the ICE server format, and a tested coturn setup.

How to use it

1. Upgrade. The Docker image already bundles the new server. On a manual install, also upgrade hbbs to CortenDesk Server 1.2.0.
2. Web client: nothing to do. It uses WebRTC by default. Open Session → Details during a session to see which path it took.
3. Desktop clients: on the device you connect from, tick Settings → General → Other → Enable WebRTC P2P connection. The device you connect to needs nothing. To see the path, hover over the session's tab.
4. Optional, recommended if anyone connects from mobile data: run a TURN server (the wiki has a tested coturn config), then point desktop clients at it with a strategy (Network → WebRTC ICE servers) and the web client with Settings → Server → Web client ICE servers. The format is stun:turn.example.com:3478, turn://user:password@turn.example.com:3478.

When WebRTC cannot connect, the session falls back to the hole punch or the relay, so turning it on breaks nothing. Full guide: WebRTC connections.

Fixed

• iPhone: tapping a text field no longer zooms the page and leaves it scrolled sideways (login screen, toolbars, web client fields).
• Web client: labels in the dock, tabs and file panel buttons are escaped (code scanning alerts).
• Livewire 4.4.8 (GHSA-mhf7-xp6r-6qrc). CortenDesk did not use the affected features.

Notes

• No database migrations.
• The browser and the device learn each other's IP addresses over WebRTC, as with the desktop client. "Web client uses WebRTC" turns it off.
• Users on mobile data or carrier NAT need a TURN server for WebRTC; without one their sessions use the relay as before. See the wiki page for a coturn config.

Everything in 1.16.x

1.16.1

• SSO settings show the RustDesk client callback URL. Sign-in from the RustDesk client returns to /login/oidc/client-callback, which the provider must allow as a redirect URI. Settings → SSO now shows it next to the console callback. (#124)
• Entra ID multi-tenant endpoints are flagged. A Provider URL ending in /common/v2.0 or /organizations/v2.0 declares a placeholder issuer that no sign-in can match. Test connection used to pass and every sign-in then failed; both now say to use your tenant's own URL. (#124)
• New wiki page: SSO provider examples for Entra ID, Keycloak, Google Workspace and Authentik.

No migrations.

1.16.0

New

• 11 languages. The console, sign-in pages, emails and the web client now come in English, Deutsch, Español, Français, Italiano, Magyar, Nederlands, Polski, Português (Brasil), Русский and 简体中文. Each user picks a language under My Account or from the language menu in the top bar; without a choice the console follows the browser, then APP_LOCALE. Each translation uses the RustDesk client's own terms and form of address. The admin API, CSV exports and notifications stay in English. Hungarian and German are by @samu112 (#111), who built the translation framework; the other languages are new and corrections are welcome (see Languages). Closes #111 and #120.
• ID whitelist in strategies. Push RustDesk 1.5's id-whitelist to devices: only the listed IDs (with * wildcards) may connect. A refused ID shows in the alarm log. (#107)
• New devices are incoming only. Settings → Server: every device that first appears can be controlled but cannot start sessions. (#107)

Fixes

• Web client keyboard on non-US layouts. æøå, €, £ are typed once instead of twice. Windows and Linux hosts get the desktop client's map mode, so AltGr characters, dead keys and punctuation land on the right key; ⋯ → Keyboard switches back to translated characters for mismatched layouts. Session details keep the user, platform and version on Wayland hosts. By @jvengin (#119; #116, #117, #118)
• Web client frame rate. The remote screen runs at up to 30 fps instead of about 10. The browser no longer acknowledges every frame before the next one is sent.
• Web client file transfer on RustDesk 1.5. File transfer, terminal and camera windows no longer fail with "Wrong password" once the host's one-time password has rotated. (#122)
• SSO accounts pending approval can be approved. They show as Awaiting approval under Users, with an Approve action. (#123)
• Health check with the bundled server. Diagnostics and /health/ready check the bundled ID server and relay over loopback, so a working install no longer reports them as down and answers 503. (#114)

Notes

• One migration: a nullable locale column on users.
• A few English messages changed slightly: counts read "1 device" instead of "1 device(s)", and web client connection errors are plain sentences followed by the server's code, e.g. "The device is offline (OFFLINE)".

docker pull marcpope/cortendesk:1.17.1
docker pull ghcr.io/marcpope/cortendesk:1.17.1