CVE-2026-126331

Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response.

• CWE-201

• https://devolutions.net/security/advisories/DEVO-2026-0041/

Published

Nov 11, 2026

Last Modified

Nov 11, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126326Improper access control in the administrative role assignmen…
• CVE-2026-126327Improper access control in the connection history in Devolut…
• CVE-2026-126328Insertion of sensitive information into sent data in the use…
• CVE-2026-126329Docker Sandboxes reuses existing state and configuration dir…7.3
• CVE-2026-12633The IPv6 neighbor-discovery code in subsys/net/ip/ipv6_nbr.c…8.1
• CVE-2026-126330Docker Sandboxes can silently republish a sandbox service af…2.4
• CVE-2026-126332Improper access control in the autofill vault search in Devo…
• CVE-2026-12634The NVS backend of the Zephyr settings subsystem (subsys/set…5.3
• CVE-2026-126343@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-126344@hono/node-server allows running the Hono application on Nod…5.4
• CVE-2026-126345basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the …5.3
• CVE-2026-126346basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPC…5.9