Devolutions Server Jira filter lookup SSRF exposes stored service account credentials
On Devolutions Server, an ordinary user can steal the Jira account password.
Summary
A server-side request forgery in the Jira ticketing filter lookup of Devolutions Server lets an authenticated low-privileged user obtain the stored Jira service account credentials. Version 2026.2.22.0 and earlier are affected.
Affected when
- Jira ticketing filter lookup in use
- authenticated low-privileged user
What to do
Affected: 2026.2.22.0 and earlier. Check that the product runs a newer version and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen