ByteOS Network

NVD Vulnerability Details :

CVE-2026-4989

Analyzed

Source-security@devolutions.net

Published At-01 Apr, 2026 | 16:23

Updated At-03 Apr, 2026 | 19:13

Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF), potentially leading to information disclosure, via a crafted API request. This issue affects Server: from 2026.1.1 through 2026.1.11, from 2025.3.1 through 2025.3.17.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Type: Secondary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CPE Matches

Devolutions

>>devolutions_server>>Versions from 2025.3.1.0(inclusive) to 2025.3.18.0(exclusive)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

Devolutions

>>devolutions_server>>Versions from 2026.1.1.0(inclusive) to 2026.1.12.0(exclusive)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-918	Secondary	security@devolutions.net

CWE ID: CWE-918

Type: Secondary

Source: security@devolutions.net

References

Hyperlink	Source	Resource
https://devolutions.net/security/advisories/DEVO-2026-0010	security@devolutions.net	Vendor Advisory

Hyperlink: https://devolutions.net/security/advisories/DEVO-2026-0010

Source: security@devolutions.net

Resource:

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History