CVE-2026-13437: PowerShell Universal Token Exposure in AI Agent Job API

Technical summary

CVE-2026-13437 is classified as CWE-201 (Insertion of Sensitive Information into Sent Data). The flaw exists in PowerShell Universal's AI Agent job API, which serializes App Tokens without encryption in responses returned to authenticated clients. An attacker with AI Agent read permissions can extract these tokens from API responses and reuse them in subsequent requests. Since App Tokens may carry elevated permissions compared to the requester's own account, this creates a privilege escalation path. The vulnerability requires prior authentication and specific job API access, limiting exposure scope but enabling lateral movement within trusted environments.

Business impact

Token theft in this context enables unauthorized lateral movement and potential privilege escalation within PowerShell Universal deployments. An attacker could use captured App Tokens to access protected scripts, automation jobs, or backend services without direct credentials. Organizations relying on PowerShell Universal for centralized script execution, runbook automation, or IT operations face risk of unauthorized task execution, data exfiltration, or configuration changes. Blast radius depends on what protected resources those App Tokens can access and whether they're scoped broadly across the environment.

Affected systems

Devolutions PowerShell Universal version 2026.2.0 is affected. Organizations running this specific version with users or service accounts granted AI Agent read permissions are vulnerable. The exposure scope is limited to authenticated users, so air-gapped or restricted-access deployments face lower risk. However, any environment where lower-privileged accounts can read AI Agent job details should be considered at risk.

Exploitability

Exploitation is straightforward for an authenticated attacker: request or monitor AI Agent job API responses to extract plaintext App Tokens, then replay those tokens in API calls to impersonate higher-privileged service accounts. No complex exploitation techniques are required. The CVSS score of 6.5 (MEDIUM) reflects the requirement for prior authentication and limited scope (confidentiality impact only), but the ease of token extraction and reuse makes this a meaningful security risk in practice.

Remediation

Upgrade to a patched version of PowerShell Universal that encrypts or redacts App Tokens in API responses. Verify the specific patched version against the official Devolutions advisory. Until patching is feasible, restrict AI Agent read permissions to only trusted accounts and monitor job API access logs for unusual token extraction patterns. Review which service accounts hold App Tokens and consider rotating them after upgrading.

Patch guidance

Check the Devolutions PowerShell Universal security advisory for the specific patched version that remediates this token exposure. Apply updates through your standard change management process, testing in non-production environments first. After patching, rotate any App Tokens that existed during the vulnerable window, as they may have been compromised. Verify the patch in your deployment by confirming that App Tokens no longer appear in plaintext in API responses.

Detection guidance

Monitor PowerShell Universal logs and API traffic for repeated requests to AI Agent job endpoints from low-privileged accounts, followed by API calls using high-privilege App Tokens. Look for suspicious patterns where a single authenticated user or service triggers many job API queries in short intervals. Implement alerting on App Token usage that doesn't correlate to the calling account's typical permissions or access patterns. Endpoint detection systems should flag any process extracting or exfiltrating authentication token strings from PowerShell Universal logs or memory.

Why prioritize this

While marked MEDIUM severity, this vulnerability deserves prompt attention in any environment where PowerShell Universal manages critical automation. Token theft enables persistent, stealthy access and sidesteps normal authentication controls. The ease of exploitation combined with the potential for privilege escalation makes this a high-priority remediation target, especially for organizations managing infrastructure or security-sensitive runbooks.

Risk score, explained

The CVSS 6.5 score reflects a network-accessible vulnerability requiring authenticated access, with high confidentiality impact but no direct integrity or availability risk. However, the practical business impact is elevated because stolen App Tokens enable unauthorized lateral movement and can lead to downstream compromise. Organizations should rate their internal risk higher if compromised tokens could reach critical systems, databases, or sensitive data repositories.

Frequently asked questions