CVE-2026-4989: Devolutions Server SSRF Vulnerability

CVE-2026-4989 Overview

CVE-2026-4989 is a Server-Side Request Forgery (SSRF) vulnerability affecting Devolutions Server, a centralized password management and privileged access management solution. The vulnerability exists in the gateway health check feature due to improper input validation, allowing a low-privileged authenticated user to craft malicious API requests that can force the server to make arbitrary outbound requests. This can potentially lead to information disclosure by accessing internal resources or services that should not be directly accessible.

Critical Impact

Authenticated attackers with low privileges can exploit this SSRF vulnerability to probe internal network infrastructure, access cloud metadata services, or exfiltrate sensitive configuration data through crafted API requests to the gateway health check endpoint.

Affected Products

• Devolutions Server versions 2026.1.1 through 2026.1.11
• Devolutions Server versions 2025.3.1 through 2025.3.17

Discovery Timeline

• 2026-04-01 - CVE-2026-4989 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-4989

Vulnerability Analysis

This vulnerability is classified under CWE-918 (Server-Side Request Forgery), which occurs when a web application fetches a remote resource based on user-supplied input without properly validating the destination URL. In the context of Devolutions Server, the gateway health check feature accepts user-controlled input that is used to construct outbound HTTP requests from the server.

The attack requires authentication, meaning an attacker must have valid credentials with at least low-level privileges to access the vulnerable API endpoint. Once authenticated, the attacker can craft malicious API requests that manipulate the health check functionality to reach arbitrary URLs. This could include internal IP addresses, localhost services, cloud metadata endpoints (such as 169.254.169.254 on AWS/Azure/GCP), or other internal infrastructure that would otherwise be inaccessible from outside the network perimeter.

The vulnerability is exploitable over the network without user interaction, making it a viable target for attackers who have obtained or compromised low-privileged credentials through phishing, credential stuffing, or other means.

Root Cause

The root cause of this vulnerability is improper input validation in the gateway health check feature. The API endpoint fails to adequately sanitize or restrict the URLs that can be specified in health check requests. Without proper allowlist validation or URL scheme restrictions, the server blindly follows user-supplied URLs, enabling SSRF attacks.

Proper implementation should include:

• URL scheme validation (restricting to http/https only)
• Destination IP address validation (blocking private IP ranges, localhost, and link-local addresses)
• Allowlisting of permitted health check destinations
• Request timeout and response size limits

Attack Vector

The attack vector is network-based and requires authentication. An attacker who has obtained valid credentials to Devolutions Server can exploit this vulnerability by sending a crafted API request to the gateway health check endpoint. The malicious request contains a URL pointing to an internal resource or service.

When the server processes this request, it initiates an outbound connection to the attacker-specified URL. The response from this internal resource is then potentially returned to the attacker or can be inferred through timing differences, error messages, or other side channels. This enables reconnaissance of internal network topology, access to cloud instance metadata, and potential data exfiltration.

For detailed technical information about this vulnerability and the specific API parameters involved, refer to the Devolutions Security Advisory.

Detection Methods for CVE-2026-4989

Indicators of Compromise

• Unusual API requests to the gateway health check endpoint with non-standard or internal IP addresses
• Outbound server connections to private IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x), localhost (127.0.0.1), or cloud metadata services (169.254.169.254)
• Anomalous health check API activity from low-privileged user accounts
• Error logs indicating failed connections to internal resources from the Devolutions Server process

Detection Strategies

• Monitor and alert on API calls to the gateway health check endpoint that contain URL parameters pointing to internal IP addresses or non-standard destinations
• Implement network-level monitoring for outbound connections from the Devolutions Server to private IP ranges or metadata endpoints
• Review authentication logs for suspicious patterns where low-privileged accounts are making excessive health check API requests
• Deploy web application firewall (WAF) rules to detect SSRF patterns in API requests

Monitoring Recommendations

• Enable verbose logging on the Devolutions Server to capture all API requests including parameters
• Configure network security monitoring to alert on SSRF-indicative traffic patterns from the server
• Set up anomaly detection for user accounts that suddenly increase their API usage, particularly for health check functionality
• Monitor DNS query logs for resolution attempts to internal hostnames from the server

How to Mitigate CVE-2026-4989

Immediate Actions Required

• Upgrade Devolutions Server to a patched version beyond 2026.1.11 (for 2026.1.x branch) or beyond 2025.3.17 (for 2025.3.x branch)
• Review audit logs for any suspicious health check API activity from low-privileged accounts
• Implement network-level egress filtering to restrict the Devolutions Server from making connections to internal IP ranges
• Consider temporarily disabling the gateway health check feature if not critical to operations until patching is complete

Patch Information

Devolutions has released security updates to address this vulnerability. Organizations should upgrade to the latest available version of Devolutions Server. For specific patch information and download links, refer to the Devolutions Security Advisory DEVO-2026-0010.

Workarounds

• Implement network segmentation to limit the Devolutions Server's ability to reach internal resources
• Configure egress firewall rules to block outbound connections from the server to private IP ranges and cloud metadata endpoints
• Apply the principle of least privilege by auditing and restricting user accounts that have access to the gateway health check API
• Deploy a reverse proxy or WAF in front of Devolutions Server configured to block SSRF attack patterns in API requests

# Example iptables egress filtering to block common SSRF targets
# Block connections to private IP ranges from Devolutions Server
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner devolutions -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner devolutions -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner devolutions -j DROP
iptables -A OUTPUT -d 169.254.169.254/32 -m owner --uid-owner devolutions -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner devolutions -j DROP