Devolutions ForumDevolutions Forum

"Reload Variables" (Settings → Files) resets all Variable values to $null after upgrading to 2026.2.3

"Reload Variables" (Settings → Files) resets all Variable values to $null after upgrading to 2026.2.3

avatar
ddenk

Product / Version: PowerShell Universal 2026.2.3
Previous version: 2026.1.7
Environment: Windows Server, self-hosted, IIS-fronted
Database backend: SQLite (database.db)
Repository path: default .universal repository directory

Summary:
Creating new Variables works correctly. However, triggering "Reload Variables" under Settings → Files causes all existing Variables — both file-based (variables.ps1) and database-backed (-Database storage option) — to have their Value reset to $null. This effectively wipes previously working configuration (including Run-As credentials used by API endpoints) every time a reload is performed.
Steps to reproduce:

  1. Run PowerShell Universal 2026.2.3 (upgraded from a prior 2026.1.7 release) with existing Variables configured (file-based and database-backed).
  2. Navigate to Settings → Files.
  3. Trigger "Reload Variables" (via the sync/reload action on that page).
  4. Observe: all previously existing Variables now show Value = $null in Platform → Variables.
  5. Newly created Variables (created after the reload) work fine until the next reload is triggered.


Downstream impact:
Because Run-As credential Variables lose their values after reload, API endpoints depending on them fail to start their proxy process:
"System.Exception: Failed to login user (1326). System.ComponentModel.Win32Exception (1326): The user name or password is incorrect.
at PowerShellUniversal.Automation.ProcessHelper.LogInOtherUser(...)
at PowerShellUniversal.Automation.JobProcessManager.StartProcessAsNewUser(...)
at PowerShellUniversal.Api.ApiGrpc.StartAsync(ExecutionEnvironment environment, Variable credential)
at PowerShellUniversal.Api.ApiService.AddEndpointAsync(Endpoint endpoint)
at PowerShellUniversal.Configuration.EndpointService.CreateAsync(...)"

Question for support:
Is this a known regression tied to the security fixes shipped in 2026.2.3 (CVE-2026-16801 — variable.ps1 escaping fix, and CVE-2026-16802 — secrets without a vault no longer written to variables.ps1)? Specifically:

  • Does the reload logic now fail to parse Variables written in the old (pre-2026.2.3) format, silently defaulting Value to $null instead of erroring?
  • Is this specific to database-backed Variables, file-based Variables, or both (we see it on both)?
  • Is there a way to prevent "Reload Variables" from wiping values until this is fixed, or a recommended manual recovery step after a reload occurs?


All Comments (1)

avatar
rubentapia

Hello ddenk,

Thank you for reporting this and for providing clear reproduction steps.

We understand that after upgrading from PowerShell Universal 2026.1.7 to 2026.2.3, using **Settings → Files → Reload Variables** causes existing file-based and database-backed Variable values to become `$null`. We also understand that this affects Run-As credential Variables and prevents dependent API endpoints from starting correctly.

The 2026.2.3 release includes changes involving `variables.ps1`, secrets, and database Variables. However, we have not yet confirmed whether the behavior you reported is directly related to those changes or represents a reproducible regression.

To help us isolate the affected path, could you please confirm the following?

* Is this occurring in a production environment?
* After the reload, is `variables.ps1` physically rewritten or changed on disk?
* Does restarting the PSU service without selecting **Reload Variables** preserve the values?
* Were the affected Variables originally created in 2026.1.7, or in an earlier version?
* Does the issue also occur with a newly created non-sensitive string Variable?

Before performing another reload, please ensure that the repository and database are backed up. We do not recommend repeating this test in production without a recoverable backup.

Because this is a public forum, please sanitize all evidence before posting. Remove credentials, tokens, license keys, cookies, private keys, full connection strings, email addresses, usernames, customer data, tenant or account identifiers, internal domains, hostnames, IP addresses, and private URLs. Please do not upload unredacted HAR files, memory dumps, database backups, or complete configuration files to this public thread.

References:

https://devolutions.net/powershell-universal/release-notes/

Best regards,

Ruben Tapia