CVE-2026-100286

Executive Summary

CVE-2026-100286 is a missing authorization vulnerability in the data source settings API of Devolutions Server version 2026.3.5.0 and earlier. An authenticated user holding only low-privileged, non-administrative access can craft an API request that causes the server to disclose integration secrets. The flaw is remotely exploitable over the network with low attack complexity and requires low privileges but no user interaction, yielding a high confidentiality impact (CVSS 6.5). No public proof-of-concept, exploit code, or CISA KEV listing exists at the time of writing, and no patch has been identified.

Technical Analysis

The vulnerability resides in the data source settings API of Devolutions Server. The core defect is a missing authorization check — a class of weakness tracked as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In authorization terms, the API endpoint responsible for managing or returning data source settings fails to enforce an administrative privilege requirement before returning sensitive content.

Because the flaw is a missing authorization control rather than an injection or memory-safety defect, exploitation does not require malformed input, buffer manipulation, or bypassing input validation. The attacker only needs to be an authenticated principal and to send a crafted request against the data source settings API. The authorization logic does not verify that the requesting user holds administrative rights, so the endpoint returns data — specifically integration secrets — to a non-administrative caller.

The precise API path, parameter names, function names, and the internal representation of the exposed secrets are not provided in the available NVD description. This report therefore describes the vulnerability at the class and mechanism level and does not assert specific endpoint paths or parameters. What is definitively established by the description is: (1) the affected component is the data source settings API; (2) the required condition is authenticated non-administrative access; (3) the trigger method is a crafted API request; and (4) the impact is disclosure of integration secrets.

"Integration secrets" in the context of an identity and privileged-access management (PAM) platform typically refers to credentials used to connect the server to external systems — for example, secrets used by data sources or integration connectors. Disclosure of such material is significant because these secrets often grant the platform access to downstream systems, and their exposure can enable lateral movement or impersonation outside the Devolutions Server instance itself. The sensitivity of these values is the reason the confidentiality subscore is rated High (C:H) while integrity and availability are unaffected (I:N/A:N).

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms a network-reachable, low-complexity attack requiring only low privilege and no user interaction, scoped to the vulnerable component, with impact confined to confidentiality.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (missing authorization on an API endpoint) and the specific facts in the NVD description. No public PoC is available. The steps below describe the mechanism at the vulnerability-class level and avoid inventing endpoint paths, parameter names, or code constructs that are not present in the source data.

1. Reconnaissance / target identification. The attacker identifies a reachable Devolutions Server instance running version 2026.3.5.0 or earlier. This can be done via public scanning (see Shodan dorks in METADATA) or through knowledge of an internal deployment. The attacker must determine that they can obtain at least one valid low-privileged account. Because the flaw requires authentication (PR:L), anonymous attackers cannot trigger it directly; the adversary either holds credentials, has obtained them through unrelated means, or possesses a legitimate low-privilege account as an insider or compromised user.

2. Triggering the missing authorization flaw. Once authenticated as a non-administrative user, the attacker interacts with the data source settings API. The endpoint that returns settings does not enforce an administrative authorization check. Because authorization is missing rather than misconfigured in a way that requires a bypass technique, the attacker simply issues a request to that API. The crafted request returns integration secrets that the caller should not be permitted to view. No payload injection, encoding trick, or privilege-escalation primitive is required — the absence of the authorization gate is sufficient.

3. Execution method. At the vulnerability-class level, the "payload" is an ordinary authenticated API request directed at the data source settings functionality. The distinguishing characteristic of the exploit is not the content of the request but the requesting identity: a non-administrative principal receives data reserved for administrators.

4. Post-exploitation impact. The attacker obtains integration secrets in cleartext (or in whatever form the API returns them). These secrets can then be used to access the external systems or data sources they protect, enabling further compromise beyond the Devolutions Server boundary. Because integrity and availability are unaffected, the immediate exploitation does not alter server state; the objective is purely exfiltration of the disclosed secrets.

Impact Assessment

Business impact centers on the disclosure of integration secrets held by a privileged-access management platform. Because Devolutions Server is designed to safeguard credentials and privileged connections, the exposure of integration secrets undermines the platform's core security promise and can cascade into compromise of downstream systems reachable with those secrets.

Affected systems are any Devolutions Server deployments at version 2026.3.5.0 or earlier where the data source settings API is reachable and where at least one non-administrative account exists (which is true for most real-world deployments). The blast radius is bounded by the reach of the disclosed integration secrets: if those secrets authenticate to high-value data sources or connectors, the effective impact can be far larger than the CVSS base score alone suggests.

Mapping CVSS subscores to impact:

• AV:N — exploitable across the network; no physical or adjacent access required.
• AC:L — no special conditions or race windows; a straightforward request triggers the flaw.
• PR:L — any authenticated non-administrative user qualifies; insider risk and any compromised low-privilege account are in scope.
• UI:N — no victim interaction is needed.
• S:U — impact is scoped to the vulnerable component and the resources it protects.
• C:H — integration secrets are highly sensitive; disclosure is a serious confidentiality loss.
• I:N / A:N — no integrity or availability impact.

The absence of a CISA KEV listing and the lack of public exploit code indicate no confirmed in-the-wild exploitation at this time, but the low complexity and low privilege requirement make the flaw attractive for post-compromise credential harvesting once an initial foothold is established.

Detection Guidance

Detection should focus on anomalous or unauthorized access to the data source settings API by non-administrative principals. Because specific endpoint paths are not published, the rules below key on the general API surface and on behavioral signals (low-privilege identity accessing sensitive settings). Analysts should tune field names and paths to their environment.

Sigma Rule

title: Potential Devolutions Server Data Source Settings API Authorization Bypass (CVE-2026-100286)
id: 8f3b2c14-7a6e-4d2f-9c1b-0a5e6d7f9a01
status: experimental
description: Detects access to the Devolutions Server data source settings API by an authenticated non-administrative user, consistent with missing authorization leading to integration secret disclosure.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100286
author: valtersit.com
date: 2026/01/01
logsource:
  category: web
  product: windows
  service: iis
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/api/'
  selection_keyword:
    cs-uri-query|contains:
      - 'datasource'
      - 'settings'
      - 'integration'
  selection_identity:
    cs-username|exists: true
  filter_admin:
    cs-username|contains:
      - 'admin'
  condition: selection_path and selection_keyword and selection_identity and not filter_admin
falsepositives:
  - Legitimate administrative configuration activity
  - Service accounts with delegated settings privileges
level: medium
tags:
  - attack.t1213
  - cve.2026.100286

Note: field names (cs-uri-stem, cs-uri-query, cs-username) are W3C IIS log fields; adjust for your web server and log pipeline.

YARA Rule

rule CVE_2026_100286_Devolutions_DataSource_Settings_Probe
{
    meta:
        description = "Detects HTTP request artifacts targeting the Devolutions Server data source settings API, consistent with CVE-2026-100286"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100286"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $api = "api/" ascii nocase
        $ds = "datasource" ascii nocase
        $set = "settings" ascii nocase
        $integ = "integration" ascii nocase
        $accept = "Accept:" ascii nocase

    condition:
        $api and $accept and 1 of ($ds, $set, $integ)
}

This signature targets request content referencing the data source settings API. Because no endpoint path is published, the rule intentionally uses broad tokens and should be tuned against known deployment paths to reduce false positives.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100286 Devolutions Server Data Source Settings API Unauthorized Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/"; http.uri; content:"datasource"; nocase; http.uri; content:"settings"; nocase; threshold: type limit, track by_src, count 5, seconds 60; reference:cve,2026-100286; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100286; classtype:attempted-recon; sid:2026100286; rev:1; metadata:service http;)

Because the exact URI path is unknown, this rule flags requests containing generic datasource/settings tokens under the API namespace. Operators should refine the content match to their real endpoint to reduce noise.

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ authentication where event.outcome == "success" ]
  [ http where url.path : ("*datasource*" or "*integration*" or "*settings*")]

This EQL sequence detects successful authentication followed by access to settings-related API paths. Investigate when user.name is not a member of the administrative group. Tune the url.path globs to match the deployment's actual API routes.

Splunk SPL Query

index=web sourcetype=iis
| eval uri = lower(cs_uri_stem . "?" . cs_uri_query)
| where (like(uri, "%/api/%") AND (like(uri, "%datasource%") OR like(uri, "%integration%") OR like(uri, "%settings%")))
| lookup admin_users.csv user AS cs_username OUTPUT is_admin
| where isnull(is_admin) OR is_admin=0
| stats count min(_time) as first_seen max(_time) as last_seen by cs_username, src_ip, uri
| where count >= 3
| sort - count

This query isolates non-administrative users making repeated requests to settings/integration API paths. The admin_users lookup should be populated from your directory service.

Wazuh OSSEC Rule

<group name="web,devolutions,cve-2026-100286">
  <rule id="100286" level="10">
    <if_sid>31100</if_sid>
    <match>/api/</match>
    <regex type="pcre2">(?i)(datasource|integration|settings)</regex>
    <description>CVE-2026-100286: Possible unauthorized access to Devolutions Server data source settings API</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_100286,</group>
  </rule>
</group>

Rule ID and parent SID (31100) should be reconciled with the local Wazuh deployment's existing web log decoder and ID allocation scheme.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network access to the Devolutions Server API so that only trusted administrative networks or jump hosts can reach the data source settings functionality.
   • Apply least privilege rigorously: audit which accounts hold authentication to the server and remove or disable dormant non-administrative accounts. Since the flaw requires only low privilege, reducing the population of authenticated users reduces exposure.
   • Where the deployment architecture permits, place the API behind an authenticating reverse proxy that enforces an additional administrative authorization layer for settings-related routes.
   • Monitor and alert on access to data source settings or integration endpoints originating from non-administrative principals, using the detection content above.

2. Patch / upgrade steps

   • No vendor patch has been identified from tracked sources. Monitor Devolutions' official security advisories and release notes for version 2026.3.5.0 and later, and for any version that explicitly addresses the missing authorization in the data source settings API.
   • Until a fixed release is published, treat the affected version range (<= 2026.3.5.0) as vulnerable and avoid exposing the endpoint to untrusted networks.

3. Long-term hardening

   • Rotate all integration secrets that may have been exposed, since disclosed credentials should be considered compromised even without confirmed exploitation.
   • Enforce server-side authorization checks for every settings API endpoint, and validate authorization in code review and automated API security testing.
   • Adopt centralized, role-based access control with deny-by-default semantics for administrative API surfaces, and log all authorization decisions for auditing.
   • Integrate SAST/DAST checks that flag missing authorization guards (CWE-200 class) during development.

References

• NVD — CVE-2026-100286: https://nvd.nist.gov/vuln/detail/CVE-2026-100286
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• Devolutions Security Advisories (monitor for a fixed release): https://devolutions.net/security/advisories/
• CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed; verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored at time of writing; verify current score): https://www.first.org/epss/

No threat actor campaigns, public proof-of-concept code, or confirmed exploit-in-the-wild activity have been identified for CVE-2026-100286 at the time of writing.