CVE-2026-17569 Information disclosure in Server
Authenticated users with view-only permissions can retrieve stored API tokens via the NetBox synchronizer endpoint, exposing sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-17569?
CVE-2026-17569 is a medium-severity vulnerability in Devolutions Devolutions Server, published on 27 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint.
This issue affects :
* Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier
Weakness: CWE-522
Which versions are affected by CVE-2026-17569?
It affects 1 product.
Products include Devolutions Devolutions Server.
How do I fix CVE-2026-17569?
No fix has been published for CVE-2026-17569 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-17569 being exploited?
There is no known exploitation of CVE-2026-17569 in the wild and no public exploit code.
Other vulnerabilities in Devolutions Devolutions Server
Sources
Also known as GHSA-552f-mjvj-8m37.