CVE-2026-45165

High

Description

An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.

SeverityHigh

CVSS8.6

Exploit probability—

Product

Idira Secrets Manager (Self-Hosted)

PublishedOct 15, 2026

First seenOct 15, 2026

Weakness typeCWE-863Incorrect authorization

How to fix

Update

Palo Alto Networks Idira Secrets Manager (Self-Hosted)13.9.1 or later

Vendor advisories

docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.9.1.htm?tocpath=Get%20started%7CRelease%20Notes%7C_____3

Affected products

Product	Affected versions	Fixed in
Palo Alto Networks Idira Secrets Manager (Self-Hosted)	13.9 ≤ v < 13.9.1	13.9.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.