CVE-2026-100288: Devolutions Server Information Disclosure

CVE-2026-100288 Overview

CVE-2026-100288 is an information disclosure vulnerability in Devolutions Server 2026.3.5.0 and earlier. The product stores sensitive authentication artifacts in cleartext within its database. An attacker with read access to the database can extract external identity provider tokens and active session identifiers through direct record inspection. Successful exploitation enables account takeover and session hijacking against federated identity integrations. The weakness is classified under [CWE-312] Cleartext Storage of Sensitive Information.

Critical Impact
Database-level read access exposes federated identity provider tokens and live session identifiers, enabling attackers to impersonate legitimate users without triggering authentication controls.

Affected Products

Devolutions Server 2026.3.5.0
Devolutions Server versions earlier than 2026.3.5.0
Deployments integrated with external identity providers

Discovery Timeline

2026-09-29 - CVE-2026-100288 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100288

Vulnerability Analysis

Devolutions Server persists two categories of sensitive material in plaintext: tokens issued by external identity providers and active session identifiers. Both classes of data grant authenticated access to the application when replayed. Because the values are stored without encryption or hashing, any principal with database read privileges can enumerate and reuse them directly.

The vulnerability requires local access with high privileges, which limits opportunistic exploitation. However, database read access is commonly available to backup operators, database administrators, monitoring tools, and replicated secondary instances. A compromised backup file or read replica extends the exposure well beyond the production database host.

The scope is marked as changed because tokens issued by an external identity provider grant access to systems and identities beyond the Devolutions Server security boundary. Confidentiality and integrity of downstream federated resources are both impacted.

Root Cause

The root cause is the absence of encryption-at-rest controls for token and session columns in the Devolutions Server database schema. Sensitive fields that should be protected with envelope encryption or one-way transforms are written and retrieved as cleartext strings.

Attack Vector

Exploitation requires read access to the underlying database. An attacker queries the tables containing identity provider tokens or session identifiers, extracts the values, and replays them against the Devolutions Server web interface or the associated identity provider APIs. No user interaction is required, and the actions leave no failed authentication artifacts because valid session state is presented.

For technical details, see the Devolutions Security Advisory DEVO-2026-0034.

Detection Methods for CVE-2026-100288

Indicators of Compromise

Unexpected SELECT queries against tables containing session or federated token data from accounts other than the Devolutions Server application service account.
Concurrent authenticated sessions for the same user from disparate source IP addresses or geolocations.
Identity provider audit logs showing token reuse from unexpected clients or user agents.
Access to Devolutions Server database backups or read replicas by principals outside the documented change control process.

Detection Strategies

Enable database audit logging on tables holding session identifiers and identity provider tokens, and alert on non-service-account reads.
Correlate Devolutions Server session activity with source IP and device fingerprint baselines to surface replay behavior.
Review external identity provider sign-in logs for tokens redeemed from IP ranges that do not belong to Devolutions Server hosts.

Monitoring Recommendations

Monitor privileged database role assignments and backup export operations for the Devolutions Server database.
Instrument alerts on new or modified linked servers, ETL jobs, or replication endpoints touching the affected tables.
Track session lifetime anomalies, including sessions that persist longer than the configured maximum or that resume after explicit logout.

How to Mitigate CVE-2026-100288

Immediate Actions Required

Upgrade Devolutions Server to a version later than 2026.3.5.0 as identified in advisory DEVO-2026-0034.
Invalidate all active sessions and revoke or rotate external identity provider tokens issued prior to the upgrade.
Audit database access rights and remove read permissions from any accounts that do not require them.
Rotate database backup encryption keys and verify that historical backups are stored on encrypted media.

Patch Information

Devolutions has published remediation guidance in the Devolutions Security Advisory DEVO-2026-0034. Administrators should apply the fixed release and follow the vendor's post-upgrade steps for session and token invalidation.

Workarounds

Restrict database access to the Devolutions Server service account and named database administrators only.
Enforce Transparent Data Encryption (TDE) on the database and encrypt all backups with keys stored outside the database host.
Reduce session lifetimes and enable strict session binding to source IP or device attributes where supported.
Isolate Devolutions Server database instances on a dedicated network segment with strict egress controls.

bash

# Configuration example: restrict SQL Server read access and enable TDE
REVOKE SELECT ON SCHEMA::dbo FROM [monitoring_reader];
ALTER DATABASE DevolutionsServer SET ENCRYPTION ON;