Sensitive Information Exposure in Devolutions PowerShell Universal AI Agent Job API

Compliance Impact

This vulnerability involves the disclosure of sensitive authentication tokens in plaintext, which could lead to unauthorized access to higher-privileged credentials.

Such exposure of sensitive information may negatively impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive authentication data and preventing unauthorized access.

Organizations using the affected software should consider this risk in their compliance assessments and apply the recommended mitigation by upgrading to version 2026.2.1 or higher.

Useful 0 Not Useful 0

Executive Summary

This vulnerability, identified as CVE-2026-13437, occurs in Devolutions PowerShell Universal version 2026.2.0. It involves the insertion of sensitive authentication tokens into the AI Agent job API responses. Specifically, an authenticated user with AI Agent read access can obtain these tokens, which are serialized in plaintext. These tokens may have higher privileges and can be reused, potentially allowing unauthorized actions.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is significant because it allows an authenticated user with limited AI Agent read access to retrieve reusable authentication tokens that may have higher privileges. This can lead to unauthorized access or actions within the system, increasing the risk of data breaches or misuse of system resources.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability in Devolutions PowerShell Universal 2026.2.0, users should upgrade to version 2026.2.1 or higher.

Useful 0 Not Useful 0