Server‑Side Request Forgery discovered in the Jira ticketing filter lookup on Devolutions Server 2026.2.22.0 and earlier allows an authenticated low‑privileged user to instruct the server to request an attacker‑controlled address. The response from that address is returned to the attacker, revealing the stored Jira service account credentials. The weakness is a classic SSRF, resulting in a confidentiality breach of account credentials that could be leveraged for further compromise of the Jira instance or other systems. The impact is therefore the exposure of privileged credentials rather than arbitrary code execution.

The vulnerability affects Devolutions Server versions 2026.2.22.0 and any earlier release. No other products or vendors are listed in the CNA data.

The attack vector requires an authenticated user with low privileges inside Devolutions Server. No CVSS score is publicly listed, and the EPSS value is not available; the vulnerability is not yet listed in CISA's KEV. Nevertheless, credential leakage presents a significant risk, especially if the attacker can control the target URL. The lack of recent exploitation reports suggests the probability is unclear, but remediation is strongly advised due to the potential impact.