"Reload Variables" (Settings → Files) resets all Variable values to $null after upgrading to 2026.2.3
Product / Version: PowerShell Universal 2026.2.3
Previous version: 2026.1.7
Environment: Windows Server, self-hosted, IIS-fronted
Database backend: SQLite (database.db)
Repository path: default .universal repository directory
Summary:
Creating new Variables works correctly. However, triggering "Reload Variables" under Settings → Files causes all existing Variables — both file-based (variables.ps1) and database-backed (-Database storage option) — to have their Value reset to $null. This effectively wipes previously working configuration (including Run-As credentials used by API endpoints) every time a reload is performed.
Steps to reproduce:
Downstream impact:
Because Run-As credential Variables lose their values after reload, API endpoints depending on them fail to start their proxy process:
"System.Exception: Failed to login user (1326). System.ComponentModel.Win32Exception (1326): The user name or password is incorrect.
at PowerShellUniversal.Automation.ProcessHelper.LogInOtherUser(...)
at PowerShellUniversal.Automation.JobProcessManager.StartProcessAsNewUser(...)
at PowerShellUniversal.Api.ApiGrpc.StartAsync(ExecutionEnvironment environment, Variable credential)
at PowerShellUniversal.Api.ApiService.AddEndpointAsync(Endpoint endpoint)
at PowerShellUniversal.Configuration.EndpointService.CreateAsync(...)"
Question for support:
Is this a known regression tied to the security fixes shipped in 2026.2.3 (CVE-2026-16801 — variable.ps1 escaping fix, and CVE-2026-16802 — secrets without a vault no longer written to variables.ps1)? Specifically:
Hello ddenk,
Thank you for reporting this and for providing clear reproduction steps.
We understand that after upgrading from PowerShell Universal 2026.1.7 to 2026.2.3, using **Settings → Files → Reload Variables** causes existing file-based and database-backed Variable values to become `$null`. We also understand that this affects Run-As credential Variables and prevents dependent API endpoints from starting correctly.
The 2026.2.3 release includes changes involving `variables.ps1`, secrets, and database Variables. However, we have not yet confirmed whether the behavior you reported is directly related to those changes or represents a reproducible regression.
To help us isolate the affected path, could you please confirm the following?
* Is this occurring in a production environment?
* After the reload, is `variables.ps1` physically rewritten or changed on disk?
* Does restarting the PSU service without selecting **Reload Variables** preserve the values?
* Were the affected Variables originally created in 2026.1.7, or in an earlier version?
* Does the issue also occur with a newly created non-sensitive string Variable?
Before performing another reload, please ensure that the repository and database are backed up. We do not recommend repeating this test in production without a recoverable backup.
Because this is a public forum, please sanitize all evidence before posting. Remove credentials, tokens, license keys, cookies, private keys, full connection strings, email addresses, usernames, customer data, tenant or account identifiers, internal domains, hostnames, IP addresses, and private URLs. Please do not upload unredacted HAR files, memory dumps, database backups, or complete configuration files to this public thread.
References:
https://devolutions.net/powershell-universal/release-notes/
Best regards,
Ruben Tapia
Hello ddenk,
Thank you for your patience while we completed our internal testing.
We were able to partially reproduce the reported behavior in PowerShell Universal 2026.2.3. In our tests, string Variables backed by SQLite became `NULL` after Reload Variables, while file-backed Variables remained intact. The behavior reproduced in clean installations, after upgrading from 2026.1.7 to 2026.2.3, and under IIS. A normal PSU restart preserved the database-backed value, and the value was lost only after the reload operation.
We plan to escalate these findings to our Development team next week for review. At this stage, we cannot confirm the underlying code-level cause or provide a resolution timeline.
As a temporary precaution, we recommend avoiding Reload Variables when database-backed Variables are present. Please also back up the SQLite database before performing any configuration reload. Values already affected may need to be restored from a valid backup or entered again.
We will update this thread when we have additional information from the internal review.
Best regards,
Ruben Tapia
Hello Ruben Tapia,
Thank you for the update.
Yes, exactly. After using Reload Variables, all existing and newly created string variables stored in the [PRODUCT] database are set to $null. Variables stored in Vault (Database), as I understand it, remain unaffected.
After restarting the services normally, all variables remain intact.
However, the database file changes when new variables are added.
Best regards,
ddenk
@ddenk @rubentapia I've opened an issue in our backlog to investigate this. I'll circle back with when we have a fix or workaround.
Adam Driscoll
PowerShell Expert and Developer at Devolutions
Hello,
Thank you for being so patient!
I'm pleased to inform you that a new version of PowerShell Universal (2026.2.4) has been released, featuring the fix for your issue.
Latest Version: Download PSU
Please let us know if this works or if you encounter any issues.
Best regards,
Maxim Robert