CVE-2026-45165
Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API
Palo Alto Networks Idira Secrets Manager (Self-Hosted)
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 13.9.1Idira Secrets Manager (Self-Hosted)CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
Text from CVE List
Affected versions 1
- Idira Secrets Manager (Self-Hosted)affected: 13.9 before 13.9.1CVE List