CVE-2026-45165: Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API
Published Oct 15, 2026
·Updated
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
Affected Software
1 affected component
Idira Conjur=13.9.0
Event History
Oct 15, 2026
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated user with limited privileges can exploit the flaw. The issue affects authorization controls on a policy branch.
2
What could an attacker do after exploitation?
Under specific circumstances, an attacker may retrieve unauthorized secrets, change administrative access controls on the affected branch, or cause a denial of service.
3
Which version is identified as affected?
The provided advisory identifies Idira Conjur version 13.9.0.