CVE-2026-4387
Description
StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\<username>\.sdm\state.kv. The file is protected only by default user-level NTFS permissions. Exploitation requires local read access to the affected user's profile directory and additional deployment and execution conditions on the target host. The condition was reported through coordinated disclosure by Hope Walker (SpecterOps).
How to fix
- StrongDM StrongDM Desktop Application23.74.0 or later
- StrongDM StrongDM Desktop Client53.77.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| StrongDM StrongDM Desktop Application | v < 23.74.0 | 23.74.0 |
| StrongDM StrongDM Desktop Client | v < 53.77.0 | 53.77.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.