CVE-2026-15637
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
14/07/2026
Last modified:
14/07/2026
Description
Improper authorization in the PAM SSH key and certificate retrieval <br />
endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an <br />
authenticated low-privileged user to disclose the private key of an SSH <br />
key or certificate PAM credential via a direct object reference to the <br />
credential identifier.