CVE-2026-13437

Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2026-0022/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:devolutions:powershell_universal:2026.2.0.0:*:*:*:*:*:*:*

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Inserción de información sensible en los datos enviados en la API de trabajos del Agente de IA en Devolutions PowerShell Universal 2026.2.0 permite a un usuario autenticado con acceso de lectura al Agente de IA obtener tokens de autenticación reutilizables, potencialmente de mayor privilegio, a través de App Tokens serializados en texto plano en las respuestas de la API de trabajos.

Information

Published : 2026-06-29 16:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-13437

Mitre link : CVE-2026-13437

CVE.ORG link : CVE-2026-13437

JSON object : View

Products Affected

devolutions

powershell_universal

CWE

CWE-201

Insertion of Sensitive Information Into Sent Data

NVD-CWE-noinfo

{"id": "CVE-2026-13437", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13437", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T16:25:18.274687Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@devolutions.net", "affectedData": [{"vendor": "Devolutions", "product": "PowerShell Universal", "versions": [{"status": "affected", "version": "2026.2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-29T16:16:35.773", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0022/", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-201"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses."}, {"lang": "es", "value": "Inserci\u00f3n de informaci\u00f3n sensible en los datos enviados en la API de trabajos del Agente de IA en Devolutions PowerShell Universal 2026.2.0 permite a un usuario autenticado con acceso de lectura al Agente de IA obtener tokens de autenticaci\u00f3n reutilizables, potencialmente de mayor privilegio, a trav\u00e9s de App Tokens serializados en texto plano en las respuestas de la API de trabajos."}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:powershell_universal:2026.2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E359772C-9B6B-4899-ACCB-EC77A63CEE9B"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}