---
id: "CVE-2026-120734"
kind: "vulnerability"
aliases: ["CVE-2026-120734"]
title: "Devolutions Server: email test leaks stored SMTP password to attacker host"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["devolutions-server", "other", "self-hosted", "smtp"]
not_affected_if: ["no-smtp-configured", "no-untrusted-users"]
published_at: "2026-11-03T21:17:04+00:00"
first_seen_at: "2026-11-03T21:19:08+00:00"
updated_at: "2026-11-03T21:27:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120734", "first_seen_at": "2026-11-03T21:19:08+00:00"}]
---

# Devolutions Server: email test leaks stored SMTP password to attacker host

The email configuration test in Devolutions Server 2026.3.13.0 and earlier sends the stored SMTP password in cleartext when the request names an attacker-controlled SMTP host. An authenticated user with access to the test action can collect that password.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Devolutions Server version against the affected range `2026.3.13.0` and earlier.
- Confirm which accounts can reach the email configuration test action in the admin settings.

## Timeline

- 2026-11-03T21:19:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120734

## From the sources

Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_