CVE-2026-90969

Executive Summary

CVE-2026-90969 is an improper access control vulnerability (CWE-284) in the vault entry listing feature of Devolutions Server 2026.2.16 and earlier. An authenticated user who lacks the view-password permission can retrieve cleartext passwords by sending a request to the entry listing endpoint with password disclosure parameters. This flaw allows a low-privileged insider or compromised account to exfiltrate secrets managed by the privileged access management (PAM) platform, directly undermining the core security guarantee of the product.

Technical Analysis

Devolutions Server is a privileged access management solution that stores and brokers credentials for administrative and privileged accounts. The platform enforces role-based and permission-based access controls on vault entries; a user's ability to list entries, view metadata, and view secrets are intended to be distinct permissions. The specific defect resides in the vault entry listing feature: the listing endpoint accepts "password disclosure parameters" that cause the response to include cleartext passwords, and the authorization check on that operation fails to verify that the requesting authenticated user actually holds the view-password permission.

The vulnerability class is broken access control / missing authorization on an object-level operation. Access control enforcement is misplaced: the endpoint authenticates the request (the attacker must be a valid authenticated user) but does not authorize the sensitive field-level operation (password disclosure) against the caller's effective permissions. Instead of stripping or masking the password field for callers lacking view-password rights, the server returns the credential material in cleartext.

Key characteristics derivable from the advisory:

• Authentication required, authorization missing: the attacker must already hold a valid session. This is not a pre-auth vulnerability.
• Privilege boundary violation: the boundary between "can list entries" and "can view passwords" is not enforced.
• Cleartext secret exposure: the response contains usable plaintext credentials, not hashes or blinded values, so no post-processing is required by the attacker.
• Server-side flaw: exploitation requires no local access, no user interaction beyond issuing the crafted listing request, and no special tooling.

The advisory does not disclose the precise endpoint path, parameter names, or request schema. Those specifics are intentionally withheld and are not reproduced here; SOC teams should treat any anomalous listing request carrying credential-disclosure semantics against Devolutions Server as suspicious. The root cause is best characterized as a missing/incorrect permission check on a data-returning operation — a recurring PAM-class defect where listing and secret-retrieval logic share a code path without a secondary permission gate on the secret field.

Because secrets are returned in cleartext, the impact is qualitatively different from metadata leakage: any credential in scope becomes immediately usable for lateral movement into the systems those secrets protect (servers, network devices, databases, cloud accounts), making this an effective privilege-escalation and credential-harvesting primitive from a merely authenticated foothold.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is currently available (EPSS 0.00138, ~3.5th percentile). The attack chain below is inferred from the vulnerability class and the advisory wording.

1. Reconnaissance / target identification. The attacker identifies an exposed Devolutions Server instance (often reachable on the internal network or, in misconfigured deployments, the internet) and obtains some valid authenticated account — a standard user, contractor, or service account with minimal vault privileges. This aligns with T1078 (Valid Accounts) and presumes an existing foothold or a legitimate-but-underprivileged account.

2. Triggering the flaw class. Using that authenticated session, the attacker issues a request to the vault entry listing endpoint that includes password disclosure parameters. Because the endpoint performs authentication but omits the view-password authorization check for the disclosure operation, the server processes the request and returns entry listing data that includes cleartext passwords. No escalation is needed on the attacker's side — the missing control is server-side.

3. Payload / execution method. At the class level, the "payload" is simply a well-formed, authenticated listing request with parameters instructing the server to disclose password fields. No memory corruption, injection, or code execution is involved; exploitation is a direct API/HTTP interaction. The attacker enumerates entries and captures any returned credentials.

4. Post-exploitation impact. Harvested cleartext passwords are immediately reusable. The attacker can authenticate to downstream systems managed by those credentials (servers, appliances, databases, cloud tenants), move laterally, escalate privilege, and potentially establish persistence — bypassing the very controls the PAM platform exists to enforce. There is no requirement for cracking or hash conversion, so the time-to-impact is minimal.

Given the absence of public exploit code, defenders should prioritize detection of anomalous listing behavior over signature-based exploit matching.

Impact Assessment

• Confidentiality: High — cleartext privileged credentials are exposed to a caller who should not be able to see them.
• Integrity: None — the advisory describes read/disclosure, not modification.
• Availability: None — no denial-of-service component.
• Attack Vector: Network (AV:N) — the vulnerable operation is a server endpoint reached over the network.
• Attack Complexity: Low (AC:L) — a straightforward authenticated request; no race conditions or special conditions stated.
• Privileges Required: Low (PR:L) — a valid authenticated account is required but no elevated or administrative role is.
• User Interaction: None (UI:N) — the attacker drives the request directly.
• Scope: Unchanged (S:U) — the flaw impacts the same security authority that manages the vulnerable component.

Business impact centers on the erosion of the PAM trust boundary: organizations rely on Devolutions Server to be the single, auditable chokepoint for privileged secrets. A single underprivileged or compromised account can convert into a large set of broadly usable credentials, enabling lateral movement and mass credential compromise. Blast radius scales with the number of vault entries the affected instance holds — in large enterprises this can include domain admin, root, database, network-device, and cloud credentials. Because the CVSS vector is presented as N/A in the supplied intelligence, no authoritative base score is asserted here; the subscores above reflect the advisory semantics only and should be validated against the vendor's published score.

Detection Guidance

Sigma Rule

title: Suspicious Devolutions Server Vault Entry Listing with Password Disclosure
id: 8f2c1a54-9b3d-4e77-a1c9-0d5f7e6b2a11
status: experimental
description: Detects authenticated requests to the Devolutions Server vault entry listing endpoint that include password disclosure parameters, indicating possible exploitation of CVE-2026-90969.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90969
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: windows
detection:
  selection_method:
    cs-method: 'GET'
  selection_endpoint:
    cs-uri-stem|contains:
      - '/vault'
      - '/entries'
      - '/entry'
  selection_params:
    cs-uri-query|contains:
      - 'password'
      - 'disclose'
      - 'reveal'
  condition: selection_method and selection_endpoint and selection_params
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate administrators with view-password permission performing authorized retrieval
level: medium
tags:
  - attack.credential_access
  - attack.t1078
  - cve.2026.90969

YARA Rule

rule CVE_2026_90969_Devolutions_PasswordDisclosure
{
    meta:
        description = "Detects HTTP traffic referencing Devolutions Server vault entry listing with password disclosure parameters (CVE-2026-90969)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90969"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "Devolutions" ascii nocase
        $p1 = "password" ascii nocase
        $p2 = "disclose" ascii nocase
        $p3 = "reveal" ascii nocase
        $e1 = "/vault" ascii nocase
        $e2 = "/entries" ascii nocase

    condition:
        $s1 and any of ($e*) and any of ($p*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90969 Devolutions Server Vault Entry Listing Password Disclosure Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"vault"; nocase; http.uri; content:"password"; nocase; classtype:attempted-recon; reference:cve,2026-90969; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90969; sid:9096901; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ authentication where event.outcome == "success" ]
  [ network where http.request.method == "GET" and
      wildcard(http.request.uri.path, "*vault*") and
      wildcard(http.request.uri.query, "*password*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=lower(uri)
| where match(uri, "(vault|entr)") AND match(uri, "(password|disclose|reveal)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,devolutions,cve-2026-90969,">
  <rule id="909690" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>vault|entr</url>
    <regex>password|disclose|reveal</regex>
    <description>CVE-2026-90969: Possible Devolutions Server vault entry listing password disclosure attempt</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>credential_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED) — no vendor fix, workaround, or patched version has been evidenced in any tracked source. All guidance below is precautionary and should be validated against the vendor.

1. Immediate mitigations

   • Restrict network exposure of the Devolutions Server instance to trusted management networks; do not expose vault endpoints directly to the internet.
   • Enforce least privilege on accounts: audit any authenticated users interacting with the PAM instance and remove stale or overly broad accounts.
   • Where the product supports granular permission configuration, verify that no non-privileged role is granted any listing/entry permission that could be combined with password disclosure.
   • Apply egress/segmentation controls so that even if credentials leak, downstream reachability from an attacker foothold is limited.
   • Monitor and alert on listing requests carrying password-disclosure parameters using the detection content above.

2. Patch / upgrade steps

   • No patch is available as of this report. Contact Devolutions support/vendor channels directly to confirm status for CVE-2026-90969 and obtain a fixed build when released.
   • Track the version line: 2026.2.16 and earlier are affected. Do not assume a later minor build is fixed without explicit confirmation.
   • Subscribe to the vendor's security advisory feed and the NVD entry for patch notification.

3. Long-term hardening

   • Rotate any credentials that may have been exposed by this flaw; assume compromise if exploitation is suspected.
   • Enforce strong authentication (MFA) and separate approval workflows for viewing privileged secrets.
   • Enable and centralize audit logging for all entry/secret access, and retain it for forensic review.
   • Adopt a defense-in-depth posture: treat PAM output as sensitive and apply DLP/monitoring to credential disclosures.
   • Conduct periodic access-control reviews and authorization testing against the entry listing and secret retrieval endpoints.

References

• NVD — CVE-2026-90969: https://nvd.nist.gov/vuln/detail/CVE-2026-90969
• Devolutions Security Advisories: https://devolutions.net/security/advisories/
• CWE-284 (Improper Access Control): https://cwe.mitre.org/data/definitions/284.html
• MITRE ATT&CK T1078 (Valid Accounts): https://attack.mitre.org/techniques/T1078/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-90969 is NOT listed as of this report)

Threat actor campaigns / exploit-in-the-wild: No public exploit code, Nuclei template, or confirmed in-the-wild exploitation is known. EPSS is 0.00138 (~3.5th percentile), indicating low predicted exploitation likelihood at time of writing. This assessment may change if a PoC or downstream authorization bypass chain is published.