CVE-2026-4989
SSRF in Devolutions Server Gateway Health Check Allows Data Disclosure
Publication date: 2026-04-01
Last updated on: 2026-04-03
Assigner: Devolutions Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| devolutions | devolutions_server | From 2025.3.1.0 (inc) to 2025.3.18.0 (exc) |
| devolutions | devolutions_server | From 2026.1.1.0 (inc) to 2026.1.12.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is caused by improper input validation in the gateway health check feature of Devolutions Server. It allows a low-privileged authenticated user to perform server-side request forgery (SSRF) by sending a specially crafted API request.
SSRF means the attacker can make the server send requests to internal or external systems that the attacker normally could not access directly.
How can this vulnerability impact me? :
The vulnerability can lead to information disclosure because an attacker can use SSRF to access sensitive internal resources or data through the server.