CVE-2026-4989

Published: Apr 1, 2026Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF), potentially leading to information disclosure, via a crafted API request. This issue affects Server: from 2026.1.1 through 2026.1.11, from 2025.3.1 through 2025.3.17.

Affected (2)

Products: Devolutions: Devolutions Server

1 product

Devolutions Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Devolutions Devolutions Server	From 2025.3.1.0 to 2025.3.18.0
Devolutions Devolutions Server	From 2026.1.1.0 to 2026.1.12.0

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

https://devolutions.net/security/advisories/DEVO-2026-0010

Source: security@devolutions.net

Vendor Advisory

Timeline

No history available yet.