Sensitive Information Exposure in Devolutions Server by Devolutions
CVE-2026-126331

Currently unrated

Key Information:

Vendor: Devolutions
Status: Server
Vendor: CVE Published:; 11 November 2026

🔔 Create Devolutions Vulnerability Alert

What is CVE-2026-126331?

An issue exists in Devolutions Server that allows authenticated users with delegated permissions to access sensitive information. Specifically, through the user list API endpoint in Devolutions Server 2026.3.13.0 and earlier, authenticated users can retrieve users’ API key secret hashes. This flaw poses significant security risks as it potentially exposes critical authentication secrets.

Affected Version(s)

Server 0 < 2026.3.14

References

https://devolutions.net/security/advisories/DEVO-2026-0041/

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 11, 2026
Vulnerability Reserved
Nov 10, 2026

CVE-2026-126331 Data

JSON