CVE-2026-16798 in PowerShell Universal
Summary
by MITRE • 07/24/2026
Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability exists within the automation jobs API of Devolutions PowerShell Universal version 2026.2.2 and earlier, representing a critical information disclosure flaw that undermines the security of authentication mechanisms. The issue stems from improper sanitization of job read responses where sensitive OAuth refresh tokens are inadvertently included in API responses despite the system's attempt to limit data exposure. Authentication is required for exploitation, but attackers with scoped job or script read permissions can leverage their access to extract confidential information from other users' accounts through routine API interactions.
The technical implementation flaw manifests when the automation jobs API processes read requests for job configurations or execution details. During these operations, the system fails to properly filter out OAuth refresh tokens that may be stored within job metadata or configuration parameters. This oversight creates an information leakage scenario where authenticated users can retrieve sensitive authentication credentials belonging to different system users. The vulnerability directly relates to CWE-201, Information Exposure Through Sent Data, and falls under the broader category of credential leakage in automated environments. Attackers can exploit this through legitimate API access patterns, making detection more challenging as the activity appears normal within the system's operational boundaries.
The operational impact of this vulnerability extends beyond simple information disclosure, creating potential for privilege escalation and lateral movement within affected systems. When an attacker successfully extracts another user's OAuth refresh token, they gain the ability to impersonate that user and potentially access additional resources or perform actions beyond their original scope. This creates a chain reaction where initial access through job read permissions can lead to broader system compromise. The vulnerability is particularly concerning in enterprise environments where PowerShell Universal serves as a central automation platform for managing critical infrastructure components.
Mitigation strategies should focus on implementing comprehensive data sanitization procedures within the API response handling logic, ensuring that all sensitive information including OAuth refresh tokens are properly stripped before any data is returned to requesting clients. Organizations should immediately upgrade to versions of Devolutions PowerShell Universal that address this vulnerability through proper input validation and output filtering mechanisms. Additionally, implementing principle of least privilege access controls can limit the scope of damage by restricting which users can read job configurations containing sensitive data. Security monitoring should be enhanced to detect anomalous API access patterns that may indicate exploitation attempts, while regular security audits of automation platforms should verify proper handling of authentication tokens and sensitive information throughout all system components.
This vulnerability aligns with ATT&CK technique T1566 for credential access through information harvesting and represents a significant risk in environments where automated job execution is prevalent. The attack surface expands when considering that refresh tokens can enable long-term unauthorized access to integrated systems, potentially allowing attackers to maintain persistence beyond typical session lifecycles. Organizations should prioritize patch management for this specific vulnerability while also conducting comprehensive assessments of their automation infrastructure to identify similar information disclosure issues in related systems and processes.