CVE-2026-4989

Description

Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF), potentially leading to information disclosure, via a crafted API request. This issue affects Server: from 2026.1.1 through 2026.1.11, from 2025.3.1 through 2025.3.17.

PUBLISHED Reserved 2026-03-27 | Published 2026-04-01 | Updated 2026-04-01 | Assigner DEVOLUTIONS

Problem types

CWE-918 Server-Side request forgery (SSRF)

Product status

References

devolutions.net/security/advisories/DEVO-2026-0010

cve.org (CVE-2026-4989)

nvd.nist.gov (CVE-2026-4989)

Download JSON