Idira Secrets Manager: Improper authorization in policy branch
Summary
An authorization flaw in Idira Secrets Manager (Self-Hosted), formerly Conjur Enterprise, version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could retrieve unauthorized secrets, change administrative access controls on the branch, or cause a denial of service. The attacker needs network access and a valid low-privilege account; no user interaction is required.
Affected
- Idira Secrets Manager (Self-Hosted) 13.9.0 (named in the CVE description)
- NVD CPE data: 13.9 up to, but not including, 13.9.1
- Versions below 13.9: Unknown.
Fixed in
- Idira Secrets Manager (Self-Hosted) 13.9.1 (security fix listed in the vendor release notes; see advisory CA26-38)
Workaround
- No workaround documented.
Exploitation
- Not listed in KEV.
- CISA SSVC: exploitation none, automatable no.
- EPSS below 1%.
- Palo Alto Networks is not aware of any malicious exploitation.
- No public proof of concept found.
Our recommendation
- Upgrade Idira Secrets Manager (Self-Hosted) to 13.9.1 or later as soon as possible.
- Read advisory CA26-38 on the CyberArk/Idira support portal for remediation details and version scope.
- Restrict low-privilege accounts and review policy-branch permissions for unexpected changes.
- Confirm the API is not reachable from the internet.
- Monitor access logs for unusual policy or secret access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Idira Secrets Manager 13.9.1 release notes docs.cyberark.com
- OpenCVE CVE-2026-45165 app.opencve.io
- CVE threatint record cve.threatint.com
- VulDB 420823 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:57.
Original description (NVD)
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.