Executive brief
Devolutions PowerShell Universal is an IT automation platform used to streamline remote management tasks with dashboards and APIs. A flaw in the slow query logging feature causes sensitive data—including application tokens, encryption keys, and stored credentials—to be written to system logs in plaintext. An authenticated user with permission to read logs can extract these secrets, potentially leading to account takeover and unauthorized access to protected systems.
Technical details
The vulnerability is an insertion of sensitive information into log files (CWE-532) affecting the slow query logging feature in PowerShell Universal when running on Microsoft SQL Server backends. The root cause is that SQL parameter values containing secrets are logged without sanitization. An authenticated attacker with log read permissions can extract application tokens, data protection key material, and credentials from the system logs. The vulnerability requires authenticated access and log read permissions to exploit. This affects PowerShell Universal versions 2026.2.5 and earlier running on SQL Server.
Affected products
- Devolutions PowerShell Universal 2026.2.5 and earlier
Timeline
- 2026-09-15: disclosed