Craft internal error exposing sensitive data
Your guess is correct... as the docs say, you should never have devMode enabled in production environments specifically for reasons like this (as well as many others).

If you find errors that are leaking sensitive server info with devMode disabled, then that is a bug and should be reported to support@buildwithcraft.com.