EUVD-2026-40127
GHSA-fw4j-fj8v-q67w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable API mandates PR:L for the AI Agent read role; C:H reflects reusable high-privilege token exposure with no integrity or availability impact.
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
Lifecycle Timeline
3DescriptionCVE.org
Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses.
AnalysisAI
Devolutions PowerShell Universal 2026.2.0 leaks serialized App Tokens in plaintext within AI Agent job API responses, enabling authenticated privilege escalation through token theft and replay. An authenticated user holding only AI Agent read access - a lower-privileged role - can extract reusable App Tokens that may carry significantly higher privileges than their own account, effectively bypassing the intended access control boundary. No public exploit code exists and CISA has not listed this in KEV, but the CVSS C:H rating reflects that successful exploitation yields credentials reusable across the platform.
Technical ContextAI
PowerShell Universal (CPE: cpe:2.3:a:devolutions:powershell_universal:*:*:*:*:*:*:*:*) is a cross-platform IT automation platform by Devolutions offering REST APIs, dashboards, and job scheduling. Its AI Agent subsystem orchestrates AI-driven automation tasks and exposes a job API for querying job state and results. The root cause is CWE-201 (Insertion of Sensitive Information Into Sent Data): when serializing job API responses, the application includes App Tokens - bearer-style credentials used for programmatic authentication throughout the platform - in plaintext rather than omitting or masking them. Because App Tokens are reusable and may be scoped to highly privileged service accounts or admin roles, their unintended inclusion in a response readable by a lower-privileged user creates a lateral movement and privilege escalation path entirely within the platform's own API surface.
RemediationAI
Apply the vendor-issued fix described in the Devolutions security advisory DEVO-2026-0022 at https://devolutions.net/security/advisories/DEVO-2026-0022/. An exact patched release version is not independently confirmed from the available data, so the advisory must be consulted directly for the precise upgrade target. As an interim compensating control, restrict AI Agent read access to the minimum set of operationally necessary, fully trusted accounts, since exploitation requires this specific role - reducing the number of principals with that role directly reduces exposure. Administrators should also audit App Token usage logs for anomalous API calls that may indicate tokens have already been harvested and replayed, and should rotate all App Tokens that could have been returned by the AI Agent job API. If the AI Agent feature is not operationally required, disabling it entirely eliminates the vulnerable endpoint without affecting other PowerShell Universal capabilities.
More in Powershell Universal
View allThe API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary comman
Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute
Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creat
Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with
PowerShell Universal before version 2026.1.4 contains insufficient authorization validation on gRPC endpoints, allowing
The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the conf
OAuth refresh token disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows authenticated users with
Information disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local attacker with file system
authentication configuration in PowerShell Universal versions up to 2026.1.3 is affected by cleartext storage of sensit
PowerShell Universal versions before 4.5.6 and 5.6.13 contain a stored cross-site scripting vulnerability that allows un
PowerShell Universal versions before 2026.1.4 contain an improper input validation vulnerability in the apps and endpoin
Unauthenticated remote access to user-defined REST endpoint OpenAPI specifications is possible in Devolutions PowerShell
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today