CVE-2026-45177

Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components. A remote, unauthenticated attacker could exploit this by submitting a specially crafted request. Under specific circumstances, this could allow the attacker to manipulate internal validation mechanisms, potentially leading to a bypass of identity verification and the unauthorized acquisition of an access token. CyberArk Security Bulletin: CA26-20

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://docs.cyberark.com/secrets-manager-saas/latest/en/content/conjurcloud/whatsnew.htm#May132026	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:paloaltonetworks:idira_secrets_manager_edge:*:*:*:*:saas:*:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Idira Secrets Manager SaaS Edge anteriores a la 1.8 presentan un control de acceso inadecuado dentro de sus componentes internos de autenticación. Un atacante remoto no autenticado podría explotar esto enviando una solicitud especialmente diseñada. Bajo circunstancias específicas, esto podría permitir al atacante manipular los mecanismos de validación internos, lo que podría llevar a una omisión de la verificación de identidad y a la adquisición no autorizada de un token de acceso. Boletín de Seguridad de CyberArk: CA26-20

Information

Published : 2026-06-11 19:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-45177

Mitre link : CVE-2026-45177

CVE.ORG link : CVE-2026-45177

JSON object : View

Products Affected

paloaltonetworks

idira_secrets_manager_edge

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-45177", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45177", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-11T19:03:15.620128Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@paloaltonetworks.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "psirt@paloaltonetworks.com", "affectedData": [{"vendor": "CyberArk Software, a Palo Alto Networks Company", "product": "Conjur Cloud (Edge Finding only)", "versions": [{"status": "affected", "changes": [{"at": "1.8", "status": "unaffected"}], "version": "1.0", "lessThan": "1.8", "versionType": "custom"}], "platforms": ["Idira Secrets Manager Saas - Edge"], "defaultStatus": "unaffected"}]}], "published": "2026-06-11T19:16:41.903", "references": [{"url": "https://docs.cyberark.com/secrets-manager-saas/latest/en/content/conjurcloud/whatsnew.htm#May132026", "tags": ["Release Notes"], "source": "psirt@paloaltonetworks.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@paloaltonetworks.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components. A remote, unauthenticated attacker could exploit this by submitting a specially crafted request. Under specific circumstances, this could allow the attacker to manipulate internal validation mechanisms, potentially leading to a bypass of identity verification and the unauthorized acquisition of an access token. CyberArk Security Bulletin: CA26-20"}, {"lang": "es", "value": "Las versiones de Idira Secrets Manager SaaS Edge anteriores a la 1.8 presentan un control de acceso inadecuado dentro de sus componentes internos de autenticaci\u00f3n. Un atacante remoto no autenticado podr\u00eda explotar esto enviando una solicitud especialmente dise\u00f1ada. Bajo circunstancias espec\u00edficas, esto podr\u00eda permitir al atacante manipular los mecanismos de validaci\u00f3n internos, lo que podr\u00eda llevar a una omisi\u00f3n de la verificaci\u00f3n de identidad y a la adquisici\u00f3n no autorizada de un token de acceso. Bolet\u00edn de Seguridad de CyberArk: CA26-20"}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:paloaltonetworks:idira_secrets_manager_edge:*:*:*:*:saas:*:*:*", "vulnerable": true, "matchCriteriaId": "9DC2958E-67FA-435D-BE15-557393CC1519", "versionEndExcluding": "1.8"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@paloaltonetworks.com"}