Description

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-29T16:17:15.307Z",
  "pubdate": "2026-09-29T16:17:15.307Z",
  "executiveSummary": "A vulnerability exists in the PAM Active Directory provider of Devolutions Server 2026.3.5, characterized by improper rule enforcement.\nThe flaw enables an authenticated user possessing PAM edit permissions to circumvent established Devolutions Gateway host rulesets.\nThis vulnerability constitutes an authorization bypass, potentially granting unauthorized access to restricted network resources or internal hosts that should be governed by security policies.\nThe impact is significant, as it undermines the integrity of the PAM (Privileged Access Management) infrastructure and the granular control mechanisms intended to isolate and secure gateway traffic.\nExploitation requires the attacker to hold specific administrative-level permissions within the PAM module, which facilitates the unauthorized modification or bypass of enforcement policies.\nOrganizations relying on Devolutions Server for centralized credential and connection management are at risk of lateral movement or unauthorized access if their PAM configurations are targeted by compromised or malicious accounts with edit rights.",
  "technicalDetails": "The vulnerability is rooted in a failure of the PAM Active Directory provider to strictly enforce validation logic when processing gateway host rulesets.\nWithin Devolutions Server 2026.3.5, the PAM component is designed to bridge Active Directory authentication with the Devolutions Gateway, ensuring that connections are filtered through defined host-based security rules.\nThe flaw manifests during the rule evaluation phase when an entity with 'PAM edit' permissions interacts with the provider's configuration interface.\nBecause the system improperly validates the enforcement state during policy updates, a malicious actor can craft or modify PAM configurations in such a way that the gateway engine ignores or fails to apply the designated host ruleset for specific connection paths.\nThe attack flow initiates with the attacker authenticating to Devolutions Server with the necessary PAM edit privileges. The attacker then manipulates the PAM Active Directory provider settings to exploit the flawed enforcement logic.\nBy intentionally misconfiguring or overriding the association between the AD provider and the gateway rules, the attacker effectively renders the security policy ineffective for their target connection.\nOnce the bypass is achieved, the Devolutions Gateway proceeds to route traffic to hosts that would otherwise be blocked by the existing security policy, essentially performing an unauthorized privilege escalation of connectivity.\nThis bypass bypasses the intended boundary enforcement, allowing internal reconnaissance or unauthorized communication with protected backend services.\nThe vulnerable component is the PAM Active Directory provider integration layer, which fails to verify that user-defined edits do not conflict with or nullify the mandatory gateway enforcement rules.\nPost-exploitation, the attacker maintains the ability to bypass restricted access controls until the ruleset is manually corrected or the vulnerable logic is patched.\nThe exploit is inherently tied to the session's privilege level, meaning the system trusts the input from the 'edit' operation implicitly, failing to implement a 'deny-by-default' or integrity-check mechanism for rule changes that deviate from established security hardening standards."
}