Description
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
Published: 2026-10-15
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Secret Disclosure and Access Control Modification
Action: Immediate Patch
AI Analysis

Impact

An authorization flaw in Idira Secrets Manager Self‑Hosted version 13.9.0 permits an authenticated user with limited privileges to perform actions on a policy branch that they should not be allowed to execute. The vulnerability can lead to retrieval of secrets that the user should not have access to, alteration of administrative access controls for the branch, or a denial of service. The weakness is classified as CWE‑863, indicating improper authorization controls within the system.

Affected Systems

The affected product is Palo Alto Networks Idira Secrets Manager (Self‑Hosted) version 13.9.0. Administrators deploying this version should confirm the patch state.

Risk and Exploitability

The vulnerability carries a high CVSS score of 8.6, indicating significant potential impact. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. Because the flaw requires authentication, an attacker who has legitimate credentials can exploit it; the attack vector is likely point‑to‑point via the REST API using normal user access.

Generated by OpenCVE AI on October 16, 2026 at 16:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Idira Secrets Manager Self‑Hosted to the latest 13.9.1 (or newer) release, which includes the authorization fix.
  • Apply the principle of least privilege to all user accounts, ensuring that individuals only have the minimum permissions required to perform their duties and cannot access or modify policy branches uncontrolled.
  • Enable and monitor detailed logging for REST API activity, reviewing logs for anomalous privileged actions or unauthorized access to secret branches.

Generated by OpenCVE AI on October 16, 2026 at 16:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
Title Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API
First Time appeared Palo Alto Networks
Palo Alto Networks idira Secrets Manager Self-hosted
Weaknesses CWE-863
CPEs cpe:2.3:a:palo_alto_networks:idira_secrets_manager_self-hosted_:*:*:*:*:*:*:*:*
Vendors & Products Palo Alto Networks
Palo Alto Networks idira Secrets Manager Self-hosted
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:M/U:Amber'}

Subscriptions

Palo Alto Networks Idira Secrets Manager Self-hosted
cve-icon MITRE

Status: PUBLISHED

Assigner: palo_alto

Published:

Updated: 2026-10-15T20:23:40.239Z

Reserved: 2026-05-08T23:00:57.502Z

Link: CVE-2026-45165

cve-icon Vulnrichment

Updated: 2026-10-15T20:20:06.419Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-15T19:17:38.653

Modified: 2026-10-15T21:17:13.347

Link: CVE-2026-45165

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T16:45:14Z

Weaknesses