CVE-2026-110805 Overview
CVE-2026-110805 is a server-side request forgery (SSRF) vulnerability in the PingOne groups endpoint of Devolutions Server. The flaw affects Devolutions Server versions 2026.3.8.0 and earlier. An authenticated low-privileged user can supply an attacker-controlled PingOne configuration through the request parameter. The endpoint then issues a server-side request using the stored PingOne application secret, which is exfiltrated to the attacker-controlled destination. The weakness is classified under CWE-918.
Critical Impact
An authenticated low-privileged user can exfiltrate the stored PingOne application secret by redirecting the server to an attacker-controlled PingOne configuration.
Affected Products
- Devolutions Server 2026.3.8.0
- Devolutions Server versions earlier than 2026.3.8.0
- Deployments integrating the PingOne groups endpoint
Discovery Timeline
- 2026-10-16 - CVE CVE-2026-110805 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-110805
Vulnerability Analysis
The vulnerability resides in the PingOne groups endpoint of Devolutions Server. The endpoint accepts PingOne configuration data through a request parameter. An authenticated low-privileged user can supply an attacker-controlled PingOne configuration, including a target host. When the server processes the request, it attaches the stored PingOne application secret and sends the outbound request to the attacker-controlled destination. The attacker captures the secret from inbound traffic.
Exploitation requires authentication, user interaction, and higher attack complexity, which limits scalable abuse. The resulting disclosure, however, exposes an integration secret that can be reused against the connected PingOne tenant. The EPSS probability is 0.124% as of 2026-10-22.
Root Cause
The endpoint trusts user-supplied PingOne configuration without validating that the destination is an approved PingOne endpoint. The server-side HTTP client then forwards the stored application secret to a host chosen by the requester. This matches the server-side request forgery pattern defined in CWE-918.
Attack Vector
An authenticated low-privileged user crafts a request to the PingOne groups endpoint containing a PingOne configuration that points at a host they control. The user induces the server to issue the outbound request, typically with user interaction in the triggering workflow. The attacker's listener records the request body and headers containing the PingOne application secret. See the Devolutions Security Advisory DEVO-2026-0036 for vendor-supplied technical detail.
Detection Methods for CVE-2026-110805
Indicators of Compromise
- Outbound HTTPS requests from the Devolutions Server host to domains that do not match legitimate PingOne tenant endpoints such as auth.pingone.com or regional equivalents.
- Application or audit log entries showing calls to the PingOne groups endpoint originating from low-privileged accounts.
- Unexpected modifications or reads of stored PingOne integration configuration by non-administrative users.
Detection Strategies
- Review Devolutions Server application logs for PingOne groups endpoint invocations correlated with non-standard target hosts in the request parameters.
- Compare outbound destinations from the server against an allowlist of PingOne hostnames and alert on deviations.
- Hunt for subsequent authentication activity on the PingOne tenant using the compromised application secret, including token requests from unfamiliar source IPs.
Monitoring Recommendations
- Forward Devolutions Server access and audit logs to a centralized log platform and retain for incident review.
- Enable egress traffic monitoring from the server host and flag connections to newly registered or uncategorized domains.
- Alert on PingOne administrative API events that follow a window of anomalous Devolutions Server activity.
How to Mitigate CVE-2026-110805
Immediate Actions Required
- Upgrade Devolutions Server to a release later than 2026.3.8.0 as published in the Devolutions Security Advisory DEVO-2026-0036.
- Rotate the PingOne application secret stored in Devolutions Server and reissue credentials for the affected integration.
- Audit PingOne tenant logs for authentication or API activity using the prior secret and revoke sessions as needed.
Patch Information
Devolutions addressed CVE-2026-110805 in a release following version 2026.3.8.0. Refer to the Devolutions Security Advisory DEVO-2026-0036 for the fixed version and upgrade instructions.
Workarounds
- Restrict access to the PingOne groups endpoint and PingOne integration configuration to administrative roles until the patch is applied.
- Apply network egress controls that limit the Devolutions Server host to known PingOne hostnames.
- Temporarily disable the PingOne integration if the fixed version cannot be deployed promptly.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
