CVE-2026-17570 in Server
Summary
by MITRE • 07/27/2026
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests.
This issue affects :
* Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/27/2026
This vulnerability represents a critical access control flaw in Devolutions Server's privilege awareness mechanism that enables low-privileged authenticated users to bypass intended security boundaries. The issue manifests within the Pluggable Authentication Modules password history endpoints where proper authorization checks fail to validate user privileges before exposing sensitive credential information. This weakness allows attackers with minimal privileges to craft specific API requests that reveal plaintext passwords stored in the system's credential management infrastructure.
The technical implementation flaw stems from inadequate input validation and privilege verification mechanisms within the authentication service layer. When legitimate API requests are made to password history endpoints, the system fails to properly authenticate whether the requesting user possesses sufficient permissions to access the requested credential data. This misconfiguration creates an information disclosure vulnerability that directly violates fundamental security principles of least privilege and principle of minimal access. The vulnerability operates at the application layer and can be exploited through standard network protocols without requiring additional attack vectors or exploitation complexity.
The operational impact of this vulnerability extends beyond simple credential exposure, as it provides attackers with access to plaintext passwords that could potentially enable further lateral movement within compromised environments. Attackers could leverage these credentials to access additional systems, escalate privileges, or conduct more sophisticated attacks leveraging the compromised authentication tokens. The affected versions span multiple release cycles indicating a persistent flaw in the development and testing processes that allowed this vulnerability to persist across several software iterations.
Security standards such as CWE-284 (Improper Access Control) directly apply to this vulnerability classification, as it represents a clear violation of access control mechanisms designed to protect sensitive information. The ATT&CK framework categorizes this under privilege escalation and credential access techniques where adversaries exploit weak access controls to obtain unauthorized information. Organizations using affected Devolutions Server versions face significant risk exposure since the vulnerability can be exploited by users with minimal authentication requirements, potentially compromising entire credential management systems.
Mitigation strategies should focus on immediate patch application for all affected Devolutions Server installations, followed by comprehensive access control policy reviews and implementation of additional monitoring for unauthorized API access attempts. Network segmentation and API gateway controls can provide additional defense-in-depth measures to limit potential exploitation impact. Organizations should also conduct thorough privilege assessments to ensure that only authorized personnel maintain access to sensitive credential management functions, while implementing automated auditing mechanisms to detect unusual API request patterns that may indicate exploitation attempts.