Live › vulnerability › CVE-2026-110805
Go to dashboardThe PingOne groups endpoint in Devolutions Server accepts an attacker-controlled PingOne configuration, so the server can be made to send requests to a host the attacker picks. An authenticated low-privileged user can use this to exfiltrate the stored PingOne application secret.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted Devolutions Server with the PingOne integration configured, where some users hold low-privileged accounts. Instances without PingOne configured, or with no untrusted authenticated users, carry less risk. Hosted services managed by the vendor are not described in the sources.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| devolutions server | vendor | < 2026.2.20.0 | 2026.2.20.0 |
| devolutions server | vendor | >= 2026.3.5.0, < 2026.3.10.0 | 2026.3.10.0 |
2026.3.8.0 (and 2026.2.20.0 for the earlier branch).2026.3.10.0 on the 2026.3.x line, or to 2026.2.20.0 on the earlier branch, per the affected ranges listed in the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.
This page as .md · .json · in your agent: get_signal("CVE-2026-110805")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.