Executive brief
Devolutions Server, a centralized platform for managing remote connections and privileged credentials, contains a security flaw in its password history management. An authenticated user with low-level access can bypass security controls to view sensitive plaintext credentials that they should not be able to see. This could lead to unauthorized access to other systems and data across the organization's infrastructure.
Technical details
An authorization bypass vulnerability (CWE-639) exists in the Privileged Access Management (PAM) password history endpoints of Devolutions Server. The flaw is rooted in improper access control, where the application fails to adequately validate user permissions when accessing historical credential data. An authenticated attacker with low privileges can submit specially crafted API requests to these endpoints to retrieve plaintext secrets. The issue affects versions 2026.1.23.0 and earlier, as well as the 2026.2.4.0 through 2026.2.12.0 range. Users are advised to upgrade to versions 2026.1.24.0 or 2026.2.14.0 to remediate the vulnerability.
Affected products
- Devolutions Server 2026.1.23.0 and earlier; 2026.2.4.0 through 2026.2.12.0
Timeline
- 2026-07-27: advisory: Initial publication of DEVO-2026-0026
- 2026-07-27: disclosed: CVE-2026-17570 published to NVD