CVEvulnerability

CVE-2026-15642

3.3 LOW Published 2026-07-14 Modified 2026-10-24 Official page ↗
Status
Analyzed
Published
2026-07-14
Last modified
2026-10-24
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-200

Description

Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected.

Affected configurations

• devolutions devolutions server (< 2026.1.23.0) • devolutions devolutions server (>= 2026.2.4.0 < 2026.2.12.0)

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References