PT-2026-48703 · Cyberark · Conjur Cloud

Published 2026-06-11 · Updated 2026-06-11 · CVE-2026-45177

Mitre

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components. A remote, unauthenticated attacker could exploit this by submitting a specially crafted request. Under specific circumstances, this could allow the attacker to manipulate internal validation mechanisms, potentially leading to a bypass of identity verification and the unauthorized acquisition of an access token. CyberArk Security Bulletin: CA26-20

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-45177

Affected Products

Conjur Cloud

References · 2

• https://docs.cyberark.com/secrets-manager-saas/latest/en/content/conjurcloud/whatsnew.htm#May132026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45177 · Security Note