CVE-2026-110805
Undergoing Analysis Undergoing Analysis - In Progress

Server-Side Request Forgery in Devolutions Server 2026.3.8.0

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Devolutions Inc.

Description
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-110805
EUVD
EUVD-2026-102877

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Devolutions Server 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a server-side request forgery (SSRF) in the PingOne groups endpoint of Devolutions Server versions 2026.3.8.0 and earlier. An authenticated user with low privileges can exploit this by manipulating a request parameter to control the PingOne configuration. This allows them to exfiltrate the stored PingOne application secret.

Detection Guidance

This vulnerability involves server-side request forgery in the PingOne groups endpoint. Detection requires monitoring network traffic for unusual requests to PingOne endpoints from Devolutions Server. Check logs for requests containing attacker-controlled PingOne configuration parameters. Validate if low-privileged users can access or modify sensitive PingOne application secrets.

Impact Analysis

If exploited, this vulnerability could allow an attacker to steal sensitive credentials like the PingOne application secret. This could lead to unauthorized access to systems, data breaches, or further compromise of the affected environment.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA due to unauthorized data exfiltration risks. An authenticated low-privileged user exploiting this SSRF flaw may access sensitive PingOne application secrets, which could include personal or protected health information. Unauthorized access to such data violates GDPR's data protection principles and HIPAA's safeguards for protected health information.

Mitigation Strategies

Update Devolutions Server to a version newer than 2026.3.8.0 to address the server-side request forgery vulnerability in the PingOne groups endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110805. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart