CVE-2026-126327 · Package
NO FIX YET
Devolutions Server 2026.3.13.0 has an access control flaw in its connection history feature. An authenticated user who lacks permission to view passwords can read historical entry passwords through the connection history API.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Devolutions Server 2026.3.13.0 with user accounts that have limited password permissions. The sources do not say whether other versions or configurations are affected.
Not affected if auth-required
Who cares devolutions-server, self-hosted
Unknown from the sources.
No fix yet, per the sources.
Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.