CVE-2026-45177: Idira Secrets Manager SaaS Edge: Authentication Bypass of an internal validation mechanism

Synopsis

An authentication bypass vulnerability affects Idira Secrets Manager SaaS Edge versions prior to 1.8. The flaw is reachable over the network without any credentials, and under specific conditions an attacker can manipulate internal validation logic to skip identity verification entirely and obtain a valid access token. Successful exploitation gives the attacker unauthorized access to secrets the token controls. A patched-image rebuild at version 1.8 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends a specially crafted request from a remote location without needing prior access to the host.

• AuthenticationNot required

  No credentials or prior account are needed; the bypass itself is the mechanism that produces an authenticated token.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  Base exploit conditions are low-complexity, though successful bypass depends on specific internal state circumstances (AT:P), meaning it is not guaranteed to succeed on every request.

Blast Radius

• An attacker who obtains the forged access token can read secrets stored in the Idira Secrets Manager Edge instance, including API keys, certificates, and credentials held in the affected vault.
• An attacker can write or overwrite secret values visible to that token, allowing poisoning of credentials consumed by downstream services.
• Integrity of any workload that trusts secrets retrieved through the compromised token is undermined without requiring any additional authentication step.