Live › vulnerability › CVE-2026-121580
Devolutions Server 2026.2.22.0 and earlier has a server-side request forgery flaw in its Jira ticketing filter lookup. An authenticated low-privileged user can point the request at a server they control and receive the stored Jira service account credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Teams running Devolutions Server 2026.2.22.0 or earlier with the Jira ticketing integration configured. The attacker needs a low-privileged account on the server, so exposure depends on who has logins to it. Installations without the Jira filter feature, or on a later version, can skip it.
No product ranges from the sources yet.
2026.2.22.02026.2.22.0 (the exact release is unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request.
This page as .md · .json · in your agent: get_signal("CVE-2026-121580")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.