CVE-2026-45165

Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in Idira Conjur Leading to Secret Exposure

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Palo Alto Networks, Inc.

Description

An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-45165

EUVD

EUVD-2026-102300

Affected Vendors & Products

Vendor	Product	Version / Range
Palo	Alto	Networks Idira Secrets Manager (Self-Hosted) 13.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This is an authorization flaw in Idira Conjur version 13.9.0. An authenticated user with limited privileges can perform unauthorized actions on a policy branch. Under specific conditions, an attacker might retrieve unauthorized secrets, modify administrative access controls, or cause a denial of service.

Detection Guidance

Detection requires checking for unauthorized policy modifications or secret access in Idira Conjur version 13.9.0. Review audit logs for unusual administrative actions on policy branches. Verify if Secrets Manager version 13.9.1 or later is installed to confirm patch status.

Impact Analysis

An attacker could access sensitive secrets, change access controls to gain higher privileges, or disrupt services by causing a denial of service. This requires the attacker to already have authenticated access with limited privileges.

Compliance Impact

The vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy). Unauthorized retrieval or alteration of secrets could result in data breaches, triggering regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade to Idira Secrets Manager - Self-Hosted version 13.9.1 or later to address the authorization flaw. Follow the installation and upgrade instructions provided in the official Secrets Manager Setup documentation.

Hi! I’m here to help you understand CVE-2026-45165. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70