CVE-2026-45178: Idira Secrets Manager Self-Hosted: Improper Access Control in Internal Cluster Endpoints

Synopsis

Improper access control in Idira Secrets Manager Self-Hosted (CyberArk Conjur Enterprise) allows a remote, authenticated attacker with standard node-level credentials to reach internal cluster endpoints that should be inaccessible to ordinary users. The attacker must authenticate over the network but needs only a low-privilege account, with no user interaction required. Successful exploitation allows the attacker to read secrets stored outside their authorization scope and to partially degrade service availability. Patched-image rebuilds at versions 13.8.1 and 14.2.6 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Conjur Enterprise cluster over the network; the vulnerable endpoints are exposed remotely, making network access a prerequisite.

• AuthenticationRequired

  Any low-privilege account with standard node-level credentials is sufficient; no administrative or elevated role is needed.

• Victim interactionNot required

  The attacker operates entirely without any action from another user or administrator.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; no race conditions or special environmental state are required to reach the vulnerable endpoints.

Blast Radius

• Reads secrets stored in Conjur Enterprise that the attacker's account is not authorized to access, exposing credentials, API keys, or other sensitive material held by the cluster.
• Partially degrades service availability of the secrets manager, which can interrupt dependent workloads that rely on Conjur for runtime credential retrieval.
• Secondary systems that consume secrets from Conjur are affected if the cluster's availability is disrupted, broadening the impact beyond the secrets manager itself.