CVE-2026-13437

{
  "id": "CVE-2026-13437",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-29T16:16:35.773",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses."
    },
    {
      "lang": "es",
      "value": "Inserción de información sensible en los datos enviados en la API de trabajos del Agente de IA en Devolutions PowerShell Universal 2026.2.0 permite a un usuario autenticado con acceso de lectura al Agente de IA obtener tokens de autenticación reutilizables, potencialmente de mayor privilegio, a través de App Tokens serializados en texto plano en las respuestas de la API de trabajos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Devolutions",
          "product": "PowerShell Universal",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2026.2.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T16:25:18.274687Z",
          "id": "CVE-2026-13437",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:devolutions:powershell_universal:2026.2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E359772C-9B6B-4899-ACCB-EC77A63CEE9B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://devolutions.net/security/advisories/DEVO-2026-0022/",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}