Authorization Flaw in Idira Conjur Affects User Privileges
CVE-2026-45165

8.6HIGH

Key Information:

Vendor

Palo Alto Networks
Status
Idira Secrets Manager (self-hosted)
Vendor
CVE Published:
15 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-45165?

An authentication vulnerability in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions within a policy branch. This can enable attackers, under certain conditions, to extract sensitive secrets, modify access controls, or lead to denial of service (DoS) situations. Security measures should be evaluated and implemented to mitigate the risks associated with this flaw.

Affected Version(s)

Idira Secrets Manager (Self-Hosted) 13.9 < 13.9.1

References

https://docs.cyberark.com/secrets-manager-sh/13.9/en/cont...
vendor-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.