CVE-2025-49831: Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) vulnerable to IAM Authenticator Bypass via Mis-configured Network Device
An attacker of Secrets Manager, Self-Hosted installations that route traffic from Secrets Manager to AWS through a misconfigured network device can reroute authentication requests to a malicious server under the attacker’s control. CyberArk believes there to be very few installations where this issue can be actively exploited, though Secrets Manager, Self-Hosted (formerly Conjur Enterprise) prior to versions 13.5.1 and 13.6.1 and Conjur OSS prior to version 1.22.1 may be affected. Conjur OSS version 1.22.1 and Secrets Manager, Self-Hosted versions 13.5.1 and 13.6.1 fix the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-49831?
CVE-2025-49831 is considered a medium to high severity vulnerability due to the potential for rerouting authentication requests.
How do I fix CVE-2025-49831?
To fix CVE-2025-49831, ensure that your network devices are properly configured to prevent traffic routing to unauthorized servers.
Which software versions are affected by CVE-2025-49831?
CVE-2025-49831 affects CyberArk Secrets Manager, Self-Hosted versions up to 13.6.1 and CyberArk Conjur OSS up to 1.22.1.
What is the impact of CVE-2025-49831 on my system?
The impact of CVE-2025-49831 is that it allows an attacker to reroute authentication requests, potentially compromising sensitive data.
Is CVE-2025-49831 exploitable in all installations?
CVE-2025-49831 is believed to be exploitable in very few installations due to the specific misconfiguration required.