CVE-2026-115830: Secret Server JWT issuance error

Published Oct 30, 2026

Updated

In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.

Event History

Oct 30, 2026

CVE Published

via MITRE·07:46 PM

Data Sourced

via MITRE·07:46 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who could exploit this issue?

An authenticated user who can meet the unspecified conditions needed to submit an unsigned JWT could receive cloudadmin permissions. The available information does not identify the exact prerequisites or affected deployment configurations.

Which versions need remediation?

Secret Server versions earlier than 12.3.1 are affected. Upgrading to 12.3.1 or later addresses the affected version range described in the advisory.

What is the potential impact of successful exploitation?

A successful attacker could obtain cloudadmin permissions. This could compromise confidentiality and integrity for impacted resources; the provided severity vector indicates no availability impact.

CVE-2026-115830: Secret Server JWT issuance error

Event History

Frequently Asked Questions

Who could exploit this issue?

Which versions need remediation?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who could exploit this issue?

Which versions need remediation?

What is the potential impact of successful exploitation?