CVE-2026-13437: PowerShell Universal Information Disclosure

CVE-2026-13437 Overview

CVE-2026-13437 is an information disclosure vulnerability in Devolutions PowerShell Universal 2026.2.0.0. The AI Agent job API returns App Tokens serialized in plaintext within job API responses. An authenticated user holding AI Agent read access can retrieve these tokens and reuse them for authentication. The exposed tokens may carry higher privileges than the original caller, enabling privilege escalation through credential reuse. The issue is tracked under [CWE-201: Insertion of Sensitive Information Into Sent Data].

Critical Impact
Authenticated users with AI Agent read access can harvest reusable App Tokens from job API responses and impersonate higher-privileged principals.

Affected Products

Devolutions PowerShell Universal 2026.2.0.0
Deployments exposing the AI Agent job API to non-administrative users
Environments where App Tokens are provisioned with elevated scopes

Discovery Timeline

2026-06-29 - CVE-2026-13437 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13437

Vulnerability Analysis

Devolutions PowerShell Universal exposes an AI Agent job API that returns job metadata to authenticated callers. In version 2026.2.0.0, the response payload embeds App Tokens as plaintext strings rather than redacting or hashing them. These App Tokens function as long-lived bearer credentials for the PowerShell Universal API. A user with only AI Agent read access can query the job endpoint, extract the tokens, and reuse them outside the AI Agent workflow. Because App Tokens can be issued with broader scopes than the requesting user's own role, the disclosure enables lateral authentication and privilege escalation across the platform.

Root Cause

The root cause is inadequate output filtering in the AI Agent job serialization logic. Sensitive credential fields are serialized alongside benign job data instead of being masked before transmission. This is a classic sensitive information exposure pattern [CWE-201], where a legitimate response channel inadvertently carries secrets to a lower-privileged consumer.

Attack Vector

Exploitation requires network access to the PowerShell Universal API and valid credentials with AI Agent read permission. The attacker authenticates, issues a request against the AI Agent job endpoint, parses the JSON response, and extracts any AppToken values present. The attacker then presents the harvested token in the Authorization header on subsequent API calls, gaining whatever privileges the token was issued with. No user interaction or additional exploitation primitive is required. See the Devolutions Security Advisory DEVO-2026-0022 for vendor details.

Detection Methods for CVE-2026-13437

Indicators of Compromise

Unexpected reads against the AI Agent job API by accounts without operational need
API authentication events using App Tokens from source addresses not previously associated with token issuance
Bulk enumeration of job history endpoints by a single principal in a short window
App Token usage patterns that diverge from the automation identity that owns the token

Detection Strategies

Enable verbose API logging in PowerShell Universal and alert on AI Agent job endpoint queries by non-service accounts
Correlate App Token authentication events with the identity that originally requested the job to detect token reuse
Baseline normal AI Agent consumers and flag deviations in caller identity, IP, or user agent

Monitoring Recommendations

Ship PowerShell Universal audit logs to a centralized SIEM for retention and correlation
Track App Token issuance and last-used timestamps to identify dormant tokens suddenly returning to use
Monitor for horizontal calls where a lower-privileged user precedes a high-privileged App Token action within a short interval

How to Mitigate CVE-2026-13437

Immediate Actions Required

Upgrade Devolutions PowerShell Universal to a fixed release as documented in advisory DEVO-2026-0022
Rotate all App Tokens that may have been exposed through the AI Agent job API
Audit AI Agent role assignments and revoke read access from users who do not require it
Review recent job API access logs for signs of token harvesting

Patch Information

Devolutions has published remediation guidance in the Devolutions Security Advisory DEVO-2026-0022. Administrators should apply the vendor-provided update that removes App Tokens from AI Agent job API responses and rotate any credentials that were reachable through the affected endpoint.

Workarounds

Restrict AI Agent read permission to trusted administrators until the patch is applied
Reduce App Token scope to the minimum required and shorten token lifetimes
Place PowerShell Universal behind a reverse proxy that enforces additional authentication on the AI Agent job routes

bash

# Configuration example: rotate and re-scope App Tokens after upgrade
# Revoke existing tokens through the Devolutions PowerShell Universal admin console,
# then reissue with least-privilege roles and short expirations.
# Refer to advisory DEVO-2026-0022 for the fixed version.