CVE-2026-90971 in Server
Summary
by MITRE • 09/15/2026
Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for datacenter discovery.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified as an SSRF in the VMware synchronization feature of Devolutions Server versions 2026.2.16 and earlier represents a critical security flaw that exploits the application's trust in user-supplied input during automated infrastructure discovery processes. This server-side request forgery allows low-privileged authenticated users to manipulate how the backend system interacts with external resources, specifically targeting VMware environments for datacenter synchronization purposes. By submitting crafted connection definitions, an attacker can redirect internal network requests from the Devolutions Server application to unintended destinations that are not accessible through normal user interfaces or API endpoints. This capability effectively bypasses standard access controls and network segmentation strategies designed to protect sensitive backend systems and cloud metadata services from unauthorized external interaction.
From a technical perspective, the flaw resides in the validation logic governing VMware synchronization requests. When an authenticated user initiates datacenter discovery by providing connection details for their own resources, the server processes these inputs without sufficiently sanitizing or restricting the destination addresses. This lack of rigorous input validation enables the attacker to specify internal IP ranges, localhost addresses, or cloud metadata endpoints such as those found in AWS EC2 instance metadata service (169.254.169.254) or Azure managed identity endpoints. The server then acts on behalf of the user by making HTTP requests to these specified targets. Because the request originates from the application server itself, it often bypasses perimeter firewalls and network access control lists that would typically block direct external connections to internal services. This mechanism allows the attacker to probe internal networks, identify running services, and potentially exfiltrate sensitive configuration data or authentication tokens stored in cloud metadata stores.
The operational impact of this vulnerability is severe due to its potential for credential theft and lateral movement within an organization's infrastructure. An attacker with low-privileged access can leverage SSRF to retrieve API keys, secret management credentials, or session tokens from internal services that are not directly exposed to the internet but are accessible by the application server. In cloud environments, accessing metadata endpoints often yields temporary security credentials for attached roles, which can be used to escalate privileges and gain broader control over cloud resources such as storage buckets, virtual machines, or database instances. Furthermore, the ability to reach internal network endpoints facilitates reconnaissance activities, allowing the attacker to map out the internal topology, identify vulnerable services on other hosts, and plan further exploitation steps. This transforms a low-privilege account into a powerful pivot point for compromising the entire environment.
This vulnerability aligns with CWE-918, which defines Server-Side Request Forgery as a flaw where an attacker coerces a server to make requests to arbitrary URLs. It also maps directly to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle or Lateral Tool Transfer variants that involve using internal services for reconnaissance and credential access. The exploitation path demonstrates how application-level logic flaws can undermine network security boundaries by leveraging the server's own permissions and connectivity privileges.
Mitigation strategies must focus on strict input validation and network isolation principles. Immediate remediation involves upgrading Devolutions Server to a version where this vulnerability has been patched, ensuring that connection definitions are validated against an allowlist of permitted domains or IP ranges rather than accepting arbitrary inputs. For environments unable to upgrade immediately, implementing web application firewall rules can help detect and block requests containing internal IP addresses or known cloud metadata endpoints in the request parameters. Additionally, network segmentation should be reviewed to ensure that the Devolutions Server cannot directly communicate with sensitive backend services or cloud metadata APIs unless explicitly required for business functionality. Principle of least privilege must also be enforced by restricting VMware synchronization permissions only to users who genuinely require this administrative capability, thereby reducing the attack surface available to low-privileged accounts.