CVE-2026-17569

Executive Summary

CVE-2026-17569 is an improper access control vulnerability in Devolutions Server, specifically within the NetBox synchronizer component. An authenticated attacker with only view‑only permissions on an entry can retrieve a stored API token by interacting with the partial connection endpoint. This token may allow further lateral movement or data exfiltration. The vulnerability affects Devolutions Server versions 2026.1.23.0 and earlier, as well as versions 2026.2.4.0 through 2026.2.12.0. No public proof‑of‑concept or exploitation code has been observed, but the attack vector is straightforward for authenticated users.

Supply Chain & Package Security

Not applicable – This vulnerability does not affect NPM, PyPI, Go, or Ruby packages.

CVSS Breakdown & Threat Level

• Base Score: 6.5 (Medium) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (the endpoint is reachable over the network)
• Attack Complexity: Low (no special conditions required)
• Privileges Required: Low (authenticated user with view‑only permissions)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (API token is fully disclosed)
• Integrity Impact: None
• Availability Impact: None

The low EPSS score (0.0%) indicates no active exploitation in the wild at the time of analysis, but the impact on confidentiality is significant because the leaked token could grant broader access.

Deep Dive & Mechanics

The NetBox synchronizer in Devolutions Server is responsible for importing and synchronizing entries from external sources. The /api/partial‑connection/ endpoint is used to retrieve partial connection data for UI rendering. Due to insufficient authorization checks, a user with "view‑only" permission on an entry can send a crafted GET request to this endpoint and receive the stored API token associated with that entry. The token is returned in the response body or headers without proper validation that the requesting user has administrative or token‑viewing privileges.

The vulnerability arises because the server does not enforce a permission boundary between viewing entry metadata and accessing the embedded API token. The partial connection endpoint reuses serialization that includes the token field for all permission levels.

Vulnerable vs. Patched Code

No official patch or source code diff is available. The vulnerability exists in the implementation of the partial connection endpoint within the NetBox synchronizer module. In a hypothetical patched version, the endpoint would:

• Check whether the requesting user has the ViewToken (or equivalent) permission before including the token in the response.
• Obfuscate or mask the token for users lacking that permission.

Exploitation & Lab Setup

Red Team

1. Prerequisites: Valid credentials for a user account with view‑only permissions on a target entry.
2. Identify Endpoint: Locate the partial connection endpoint, typically at /api/v1/partial‑connection/{entryId} (path may vary).
3. Send Request:

   curl -X GET 'https://devolutions-server.example/api/v1/partial-connection/12345' \
        -H 'Authorization: Bearer <viewer_token>' \
        -H 'Accept: application/json'
   

4. Extract Token: The response JSON includes a apiToken field. Copy the token.
5. Use Token for Privilege Escalation: Reuse the obtained token in API calls to perform actions as the owner of the entry.

Blue Team

• Monitor for Unusual API Calls: Identify requests to /api/*/partial‑connection/* from users who do not normally use the NetBox synchronizer.
• Honeytoken: Insert a fake entry with a decoy API token and alert when it is accessed.
• Rate‑Limit: Implement rate limiting on the partial connection endpoint to slow down token harvesting.
• Audit Permissions: Regularly review view‑only accounts and remove unnecessary access to entries containing sensitive API tokens.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule Detect_PartialConnection_TokenLeak {
    meta:
        description = "Detects HTTP responses containing Devolutions API tokens from partial connection endpoint"
        author = "Valters IT"
        date = "2026-03-10"
        reference = "CVE-2026-17569"
    strings:
        $token_pattern = /"apiToken"\s*:\s*"[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+/ 
        $endpoint = "/api/v1/partial-connection" nocase
    condition:
        $endpoint and $token_pattern
}

Sigma Rule

title: Devolutions Server API Token Leak via Partial Connection
id: 3b1c2d4e-5f6a-4b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects HTTP GET requests to the partial connection endpoint by low‑privileged users
author: Valters IT
date: 2026-03-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17569
logsource:
    category: webserver
    product: iis
    service: http
detection:
    selection:
        cs-uri-query|contains: 
            - "/api/v1/partial-connection"
        cs-method: "GET"
        cs-username|startswith: "viewer_"
    condition: selection
falsepositives:
    - Legitimate admin performing inspections
level: medium
tags:
    - attack.t1552

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2026-17569 - Devolutions API Token Leak Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/v1/partial-connection"; http_uri;
    pcre:"/apiToken/i";
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

• Immediate:
  • Upgrade to a patched version once released (contact Devolutions support for timeline).
  • Review and revoke API tokens that may have been exposed.
  • Restrict view‑only permissions to only necessary entries.
• Workaround:
  • Restrict network access to the Devolutions Server API (e.g., allow only trusted IP ranges).
  • Enable detailed audit logging for the partial connection endpoint.
• Long‑term:
  • Implement role‑based access control (RBAC) that enforces token visibility.
  • Regularly assess third‑party synchronizer integrations.

Valters IT
Cyber Threat Intelligence Report