What is the CVSS score of CVE-2026-4989?

CVE-2026-4989 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Server CVE-2026-4989

EUVD-2026-17929 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-01 DEVOLUTIONS

GHSA-w89v-w2pq-cc25

SSRF Information Disclosure Server

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 15:30 euvd

EUVD-2026-17929

Analysis Generated

Apr 01, 2026 - 15:30 vuln.today

CVE Published

Apr 01, 2026 - 15:07 nvd

MEDIUM 4.3

DescriptionCVE.org

Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF), potentially leading to information disclosure, via a crafted API request. This issue affects Server: from 2026.1.1 through 2026.1.11, from 2025.3.1 through 2025.3.17.

AnalysisAI

Server-side request forgery (SSRF) in Devolutions Server gateway health check feature allows low-privileged authenticated users to bypass input validation and trigger arbitrary requests, potentially disclosing sensitive information from internal systems or network resources. Affected versions are 2026.1.1-2026.1.11 and 2025.3.1-2025.3.17. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in the gateway health check API endpoint, a feature used to validate connectivity and status of backend gateway services. The root cause is improper input validation (CWE-918: Server-Side Request Forgery) that fails to restrict the target URL or resource that the health check mechanism can contact. Because the health check runs in the context of the Devolutions Server process (which typically has network access to internal systems), an attacker can craft malicious API requests to cause the server to issue HTTP requests to internal IP ranges, localhost services, or cloud metadata endpoints-bypassing network segmentation and revealing configuration, credentials, or other sensitive data. The CPE indicates all versions of Devolutions Server are potentially affected within the specified ranges.

RemediationAI

Upgrade Devolutions Server to a patched version released after 2026.1.11 or 2025.3.17 (exact fix versions are not specified in available data, so consult the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0010 for the specific recommended upgrade path). As an interim measure, restrict API access to the gateway health check endpoint to trusted administrative users, implement network-level controls to limit outbound requests from the Devolutions Server process to designated gateways only, and monitor API logs for suspicious health check requests containing unusual or internal IP addresses. Patch availability and exact fix versions should be confirmed directly with Devolutions through their security advisory.