CyberCVE

CVE-2026-45178

Idira Secrets Manager Self-Hosted: Improper Access Control in Internal Cluster Endpoints

Severity
High 8.4
CVSS 4.0
Exploited
Not listed
EPSS
0.004
28.8th percentile
Discovered by
Vendor
Published by the vendor
Published
Jun 11, 2026
Assigned by palo_alto

Description

Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20

Weakness: CWE-284

Affected products

Vendor Product Category Matched by

No product mapping yet — this CVE is pending taxonomy review.

Vendor-reported affected versions (4)
  • CyberArk Software, a Palo Alto Networks Company · Conjur Enterprise
  • CyberArk Software, a Palo Alto Networks Company · Conjur Enterprise
  • CyberArk Software, a Palo Alto Networks Company · Conjur Enterprise
  • CyberArk Software, a Palo Alto Networks Company · Conjur Enterprise

Credit

Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue

Vendor remediation

VERSION MINOR VERSION SUGGESTED SOLUTION Conjur Enterprise on Idira Secrets Manager 13.0 through 13.8.0 Upgrade to 13.8.1 or later. Conjur Enterprise on Central Credential Provider (CCP) 14.0 through 14.2.5 Upgrade to 14.2.6 or later. Conjur Enterprise on z/OS Credential Provider 14.0 through 14.2.5 Upgrade to 14.2.6 or later. Conjur Enterprise on Credential Provider (CP) 14.0 through 14.2.5 Upgrade to 14.2.6 or later.

References