CVE-2026-17570: Devolutions Server Information Disclosure

CVE-2026-17570 Overview

CVE-2026-17570 is an improper access control vulnerability [CWE-639] affecting the Privileged Access Management (PAM) password history endpoints in Devolutions Server. An authenticated low-privileged user can send crafted API requests to these endpoints and retrieve plaintext credential secrets they are not authorized to view. The flaw compromises confidentiality of stored privileged credentials, which is the core function a PAM product is designed to protect. Devolutions published security advisory DEVO-2026-0026 describing the issue and affected releases.

Critical Impact
An authenticated low-privileged account can disclose plaintext privileged credentials by calling the PAM password history API, undermining the trust boundary of the vault.

Affected Products

Devolutions Server 2026.2.4.0 through 2026.2.12.0
Devolutions Server 2026.1.23.0 and earlier
Devolutions Server PAM password history API endpoints

Discovery Timeline

2026-07-27 - CVE-2026-17570 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-17570

Vulnerability Analysis

Devolutions Server provides PAM features that store and rotate privileged credentials. The PAM password history endpoints return previous secret values associated with a managed credential. In vulnerable releases, these endpoints do not adequately enforce that the caller has permission to view the underlying credential. Any authenticated user with low privileges can invoke the endpoint and receive plaintext secrets in the response body.

The weakness maps to [CWE-639] Authorization Bypass Through User-Controlled Key. The server validates authentication but not entitlement to the specific credential object referenced in the request. This is a classic insecure direct object reference against a high-value data type: rotated privileged passwords.

The issue affects Devolutions Server 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier. Attackers must hold valid Devolutions Server credentials, so exploitation is limited to insiders or attackers who have already compromised a low-tier account.

Root Cause

The root cause is missing object-level authorization on the PAM password history endpoints. The server checks that the requester is authenticated but omits the permission check tying the requesting user to the credential identifier passed in the API request. Historical secret retrieval therefore executes with only session-level trust rather than per-object entitlement.

Attack Vector

The attack vector is network-accessible authenticated API abuse. An attacker with a low-privileged Devolutions Server account enumerates or guesses credential identifiers and issues crafted requests against the password history endpoints. The response returns plaintext secret values from the credential rotation history. No user interaction and no elevated privileges are required to complete the disclosure.

No verified public exploit code is available. See the Devolutions Security Advisory DEVO-2026-0026 for vendor technical details.

Detection Methods for CVE-2026-17570

Indicators of Compromise

Unexpected HTTP requests from low-privileged accounts to Devolutions Server PAM password history API paths
Bursts of sequential or enumerated credential identifiers issued by a single session or API token
Authenticated users retrieving password history for credentials outside their normal entra of access

Detection Strategies

Review Devolutions Server audit logs for password history read events correlated to user role and permitted vaults
Alert when a user account retrieves password history entries for credentials it has never actively used
Baseline API call volume per user against the password history endpoints and flag statistical outliers

Monitoring Recommendations

Forward Devolutions Server audit and API logs to a centralized SIEM for retention and correlation
Track authentication events for low-privileged Devolutions accounts alongside PAM API activity
Monitor for privilege changes or new session tokens preceding password history retrieval bursts

How to Mitigate CVE-2026-17570

Immediate Actions Required

Upgrade Devolutions Server to a fixed release as identified in advisory DEVO-2026-0026
Rotate all privileged credentials whose password history may have been exposed to non-authorized users
Review Devolutions Server audit logs for prior access to the PAM password history endpoints by low-privileged accounts
Restrict Devolutions Server administrative APIs to trusted network segments where feasible

Patch Information

Devolutions has published fixes described in Devolutions Security Advisory DEVO-2026-0026. Administrators running Devolutions Server 2026.2.4.0 through 2026.2.12.0 or 2026.1.23.0 and earlier must upgrade to a patched release identified in the advisory. Apply the update in a maintenance window and verify PAM entitlements after upgrade.

Workarounds

Reduce the number of accounts with any access to PAM-managed vaults until the patch is applied
Disable or firewall the Devolutions Server API surface from untrusted internal networks
Force password rotation on all PAM-managed credentials to invalidate any historical secrets that may have been disclosed
Increase audit log retention and review cadence for PAM read operations during the exposure window

bash

# Configuration example: restrict Devolutions Server API access at the network layer
# Example firewall rule limiting API access to an administrative subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP