WebRTC changes how RustDesk moves pixels through your firewall, the ID whitelist is the access-control feature you've been missing, and the Linux service just got quieter about how it does its job. Time to update your relay box.

RustDesk 1.5.0 is out, and if you self-host the open-source remote desktop tool instead of renting someone else's screen-sharing service, this release changes your operational planning in a few concrete ways. Here is the upgrade checklist, in order of importance.

1. Turn on the ID whitelist — this is the real security story

The headline feature for anyone running RustDesk on machines reachable from the internet is the new ID whitelist. Until now, controlling who could connect to your RustDesk client was mostly about passwords. A whitelist is a different, stronger primitive: only the listed IDs get to knock at all.

If you expose a RustDesk client on a server or a family member's PC, enable the whitelist immediately after upgrading and add only the IDs you control. Combined with a strong password, it shrinks your attack surface from "everyone who can guess an ID" to "a list you wrote yourself." This is the single highest-value action in this release.

2. WebRTC is here — rethink your relay and firewall rules

Version 1.5.0 adds WebRTC as a transport. If you run your own hbbs/hbbr relay servers, this matters: WebRTC brings different NAT-traversal and UDP behavior than the classic direct connections. Before rolling 1.5.0 across your fleet, check your firewall rules and relay topology — make sure the UDP paths WebRTC needs are actually open, and confirm your relay handles the new flow the way you expect. Test with one client pair first, not your whole homelab at 2 a.m.

3. The Linux service stopped shelling out

A quiet but meaningful hardening change: on Linux, the service loop drops shell usage. Fewer shell invocations in a privileged service loop means fewer places where quoting bugs or environment weirdness can turn into something worse. You will not notice anything different day to day — that is the point. Defense in depth that you never have to think about.

4. Temporary passwords rotate at the right moment

Temporary passwords now rotate when a peer is let in, not when they leave. The old behavior left a window where a password that had already been used was still valid for a while. Small change, correct direction.

5. The rest of the greatest-hits list

  • HDR tonemap — remote sessions on HDR displays look right now.
  • Opt-in clipboard sync between sessions — off by default, on when you ask. The privacy-friendly default is the correct one for a remote access tool.
  • FFmpeg 7.1.1 — fixes HEVC deadlocks, which matters if you stream high-resolution screens.
  • macOS silent auto-update — less nagging on the Macs you support.
  • Android scoped storage + target API 36 — keeps the mobile client on the right side of Play Store policies.

The upgrade drill

  1. Upgrade your self-hosted hbbs/hbbr relay servers first.
  2. Upgrade clients one platform at a time; confirm a working session between each pair before moving on.
  3. Enable the ID whitelist on every internet-reachable client and list only your own IDs.
  4. Rotate any temporary passwords you have lying around in notes or chat history.
  5. If you use WebRTC, verify UDP connectivity through your firewall before declaring victory.

RustDesk remains one of the best answers to "I want TeamViewer, but on my own infrastructure." Version 1.5.0 does not change the pitch — it just makes the self-hosted version meaningfully harder to abuse.

Sources: RustDesk 1.5.0 release notes (GitHub, rustdesk/rustdesk).