CVE-2026-45165
Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API
Exploited
Not listed
EPSS
—
Discovered by
Third party
Vendor-published field
Published
Oct 15, 2026
Assigned by palo_alto
Description
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
Weakness: CWE-863
Affected products
| Vendor | Product | Category | Matched by |
|---|
No product mapping yet — this CVE is pending taxonomy review.
Vendor-reported products (1)
- Palo Alto Networks · Idira Secrets Manager (Self-Hosted)
Credit
George Chen