This vulnerability (CWE-200) involves the insertion of sensitive information, specifically the Azure Key Vault client secret, into the Recovery Kit response file generated by Devolutions Server versions 2026.1.22.0 and 2026.2.11.0. An attacker who can access this response file can retrieve the client secret in cleartext despite configuration settings intended to exclude such sensitive data. The vulnerability has a CVSS score of 3.3 (low severity) with local attack vector, low attack complexity, no privileges required, and requires user interaction. The affected product is a cloud service, and the vendor manages remediation server-side.

An attacker with access to the generated Recovery Kit response file can obtain the Azure Key Vault client secret in cleartext. This could lead to unauthorized access to secrets stored in Azure Key Vault. However, the vulnerability requires local access to the response file and user interaction, limiting the ease of exploitation. There is no indication of integrity or availability impact.

Since Devolutions Server is a cloud-hosted service, the vendor manages remediation on their side. A patch is available, and users should verify with Devolutions that their service instance has been updated to address this issue. No additional user action is required beyond ensuring the service is up to date as per vendor advisories.