CVE-2026-110805: SSRF

Q: Who can exploit this issue?

An authenticated low-privileged user can exploit it. The issue affects Devolutions Server 2026.3.8.0 and earlier.

Q: What must an attacker control to exploit it?

The attacker needs to supply an attacker-controlled PingOne configuration through the request parameter to the PingOne groups endpoint. Exploitation can cause the server to disclose the stored PingOne application secret.

Published Oct 16, 2026

Updated

Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.

Affected Software

1 affected component

Devolutions Devolutions Server<=2026.3.8.0

Event History

Oct 16, 2026

CVE Published

via MITRE·01:46 PM

Data Sourced

via MITRE·01:46 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated low-privileged user can exploit it. The issue affects Devolutions Server 2026.3.8.0 and earlier.

What must an attacker control to exploit it?

The attacker needs to supply an attacker-controlled PingOne configuration through the request parameter to the PingOne groups endpoint. Exploitation can cause the server to disclose the stored PingOne application secret.