CVE-2026-8694: PowerShell Universal Info Disclosure Flaw

CVE-2026-8694 Overview

CVE-2026-8694 is an improper access control vulnerability in Devolutions PowerShell Universal versions 2026.1.7 and earlier. The flaw allows an unauthenticated remote attacker to retrieve the OpenAPI specification of user-defined REST endpoints. Attackers can query the affected service over the network without credentials and enumerate exposed API surface area. The weakness is classified under [CWE-306] Missing Authentication for Critical Function. Devolutions published security advisory DEVO-2026-0016 describing the issue. The vulnerability affects information integrity rather than confidentiality of stored data, exposing structural metadata that supports follow-on attacks against the documented endpoints.

Critical Impact
Unauthenticated remote attackers can obtain the OpenAPI specification of user-defined REST endpoints in PowerShell Universal, exposing API structure useful for reconnaissance.

Affected Products

Devolutions PowerShell Universal 2026.1.7
Devolutions PowerShell Universal versions earlier than 2026.1.7
Ironmansoftware PowerShell Universal (all builds in the affected branch)

Discovery Timeline

2026-06-12 - CVE-2026-8694 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-8694

Vulnerability Analysis

The vulnerability resides in how PowerShell Universal exposes OpenAPI metadata for user-defined REST endpoints. The application serves the OpenAPI specification without enforcing authentication checks. A remote attacker can issue an HTTP request and receive a structured description of available endpoints, parameters, request bodies, and response schemas. This metadata is intended for authorized API consumers but is reachable without credentials in affected versions.

The Devolutions advisory DEVO-2026-0016 confirms the access control gap and identifies 2026.1.7 as the last affected release. The disclosed metadata can reveal internal route names, parameter formats, and expected payload structures that administrators assumed were private. Attackers can then craft targeted requests against the documented endpoints, narrow brute-force scopes, or identify business logic that warrants closer inspection.

Root Cause

The root cause is missing authentication enforcement on the OpenAPI specification handler. The endpoint that serves the specification does not verify session or token credentials before returning the document. This pattern matches [CWE-306], where a sensitive function omits a required authentication step. The product design treats the specification route as public despite containing details about non-public user-defined endpoints.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker with HTTP reachability to the PowerShell Universal instance requests the OpenAPI document path. The server returns the specification content for user-defined REST endpoints. The attacker parses the JSON or YAML output to map the API surface and identify endpoints worth targeting in subsequent stages.

No verified public exploit code is available at the time of publication. Refer to the Devolutions Security Advisory DEVO-2026-0016 for vendor-confirmed technical details.

Detection Methods for CVE-2026-8694

Indicators of Compromise

Unauthenticated HTTP GET requests targeting OpenAPI or Swagger specification paths on PowerShell Universal instances.
Requests from unexpected source IP ranges retrieving large JSON or YAML payloads from API documentation routes.
Anonymous client User-Agent strings repeatedly fetching API metadata endpoints prior to targeted endpoint probing.

Detection Strategies

Inspect PowerShell Universal access logs for requests to OpenAPI specification routes that lack an associated authenticated session.
Correlate enumeration of the specification endpoint with subsequent requests against user-defined REST endpoints from the same source.
Apply web application firewall rules that flag unauthenticated retrieval of API documentation routes on management interfaces.

Monitoring Recommendations

Monitor the network segment hosting PowerShell Universal for inbound HTTP traffic originating outside trusted administrative ranges.
Alert on response payloads from the OpenAPI route exceeding baseline size, indicating full specification retrieval.
Track repeated access patterns from a single source enumerating metadata followed by parameterized endpoint requests.

How to Mitigate CVE-2026-8694

Immediate Actions Required

Upgrade PowerShell Universal to a version released after 2026.1.7 as identified in advisory DEVO-2026-0016.
Restrict network access to the PowerShell Universal management interface using firewall rules or reverse proxy allowlists.
Audit user-defined REST endpoints for sensitive parameters that may have been exposed through the OpenAPI document.

Patch Information

Devolutions has released fixed builds following PowerShell Universal 2026.1.7. Administrators should consult the Devolutions Security Advisory DEVO-2026-0016 for the exact remediated version and upgrade procedure. Apply the patch through the standard PowerShell Universal upgrade workflow and validate that the OpenAPI route requires authentication after the update.

Workarounds

Place PowerShell Universal behind a reverse proxy that enforces authentication before requests reach the application.
Block external access to OpenAPI and Swagger paths at the network or proxy layer until the patch is applied.
Limit exposure of the service to trusted administrative networks or VPN-accessible segments only.

bash

# Example reverse proxy rule blocking unauthenticated OpenAPI access
location ~* /(swagger|openapi|api-docs) {
    auth_request /auth;
    proxy_pass http://powershell-universal-backend;
}