EUVD-2026-102300Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with limited-privilege Conjur account
-
ExploitTarget a vulnerable policy branch
-
ExecutionAbuse incorrect authorization check (CWE-863)
-
ImpactRetrieve unauthorized secrets or alter branch access controls
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid, authenticated Conjur user who already holds limited privileges and some level of access to a policy branch (PR:L); there is no unauthenticated path and no default-configuration mass-exploitation vector. The escalated outcomes - retrieving unauthorized secrets, altering administrative access controls on the branch, or causing a DoS - occur only 'under specific circumstances' per the vendor, implying the attacker's existing role and the branch's policy layout must line up for the authorization check to be bypassed. No user interaction is required (UI:N), and exploitation is limited to deployments running the affected 13.9.0 release; the primary limiting factor is the need for pre-existing authenticated, low-privilege account access. |
| Impact | The input CVSS 4.0 score of 8.6 (High) with vector AV:N/AC:L/PR:L/UI:N/VC:H/VI:H describes a network-reachable, low-complexity authorization flaw (CWE-863) exploitable by an already-authenticated, limited-privilege user - meaning the attacker must already possess valid Conjur credentials, which materially lowers real-world risk versus an unauthenticated remote flaw. No EPSS score, KEV listing, or POC indicator was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the exploit-maturity field in the supplied vector is undefined (E:X). This is a genuine priority for organizations running the affected version because the target is a secrets-management platform and the impact includes theft of unauthorized secrets and alteration of administrative access controls (VC:H/VI:H), but the authenticated-insider prerequisite makes it a targeted/insider-leaning risk rather than an internet-wide mass-exploitation threat. Two data conflicts must be flagged: (1) the description explicitly claims a denial-of-service outcome, yet the supplied CVSS 4.0 vector sets VA:N (no availability impact) - verify the DoS impact with the vendor; (2) the product is named 'Idira Conjur' in the description but the sole reference points to CyberArk Secrets Manager / Conjur 13.9.1 release notes, so the product identity should be treated as CyberArk Conjur pending confirmation. |
| Exploit ScenarioDerived | An attacker holding a low-privilege but authenticated Conjur account (an insider, or an outsider who has phished/compromised limited credentials) targets a policy branch and abuses the incorrect-authorization check to read secrets they are not entitled to and to modify administrative access controls on that branch, potentially escalating their effective privileges. Given AV:N/AC:L/PR:L/UI:N, the action requires only an authenticated API session and no user interaction. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Authorization bypass in CyberArk Conjur 13.9.0 allows an authenticated user holding only limited privileges to perform actions on a policy branch they are not entitled to, and under specific circumstances to retrieve unauthorized secrets, alter administrative access controls on that branch, or cause a denial of service. The flaw is network-reachable and low-complexity (CVSS 4.0 8.6; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality and integrity impact), but it requires a pre-existing, valid Conjur account with access to the affected policy branch, so there is no unauthenticated or default-configuration mass-exploitation path. No public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status; the primary exposure is to Conjur 13.9.0 deployments with broad multi-tenant policy trees and loosely scoped low-privilege roles.
RemediationAI
Upgrade affected Conjur 13.9.0 deployments to the patched 13.9.1 release documented in CyberArk's release notes (https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.9.1.htm) and verify the applied build against the vendor bulletin CA26-38, since patch availability is asserted by the vendor advisory rather than by a tagged fix version confirmed in this dataset. Where an immediate upgrade is not possible, apply compensating controls that address the authorization gap directly: inventory and shrink the privileges of low-privilege roles that hold any permission at or above the affected policy branch, since the exploit requires a pre-existing authenticated identity with branch access (PR:L) - the trade-off is that over-restricting branch permissions can break service accounts and automated secret retrieval, so changes should be staged and tested; audit policy branches for non-standard role grants or wildcard permissions that expand a limited role's effective reach, since the bypass lets an attacker rewrite administrative access controls on the branch, and any such edit made outside a change window should be treated as compromise; and reduce network exposure of the Conjur API/UI (AV:N) to trusted management networks or VPN, accepting that this degrades usability for distributed CI/CD consumers. Because secrets may already have been read or branch ACLs altered, rotate secrets scoped to suspect branches and review audit logs for anomalous secret retrievals or permission changes after remediation, rather than relying on patching alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Conjur is a secrets-management platform that models access through a hierarchical policy tree: policy files declare nodes (branches) and attach roles, privileges, and permissions to them, and the server enforces authorization when a client requests a secret or modifies policy. CWE-863 (Incorrect Authorization) means the server's authorization check for operations against a policy branch can be satisfied by an identity that should not hold the required privilege on that branch - i.e., the effective permission set is evaluated incorrectly rather than the user lacking authentication entirely. Because Conjur's security boundary is the policy branch, a bypass there is high-impact: a low-privilege role can be used as a pivot to read secrets scoped to a sibling/child branch, to rewrite access-control entries that govern administrative roles, or to induce a denial-of-service condition on the branch. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) confirms the attacker must already hold valid credentials with limited privileges, and the vendor's qualifier that impact occurs only 'under specific circumstances' implies exploitability depends on the interaction between the attacker's existing grants and the target branch's policy layout. Only the 13.9.0 release is identified as affected, and CyberArk's referenced release notes are for 13.9.1.
Know when Cyberark gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:M/U:Amber
Authenticated low-privilege user over the network (PR:L, AV:N), no interaction; secret theft and ACL tampering give C:H/I:H, and the conditional DoS gives A:L rather than the vendor's A:N.
Primary rating from Vendor (paloaltonetworks).
CVSS VectorVendor: paloaltonetworks
Lifecycle Timeline
2DescriptionCVE.org
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
Executive ViewAI
CyberArk Conjur 13.9.0 contains an authorization bypass that lets an already-authenticated user with only limited privileges act outside their entitled policy branch, potentially exposing secrets, tampering with administrative access controls, or disrupting availability. Organizations running Conjur 13.9.0 as a secrets-management backbone - especially multi-tenant deployments with broad policy trees and loosely scoped low-privilege roles - should treat this as a material risk to credential confidentiality and access governance. Leadership should care because the affected system often holds the keys to other critical systems, so a single mis-scoped identity could escalate into downstream compromise or service disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to Conjur 13.9.0 endpoints; audit and aggressively minimize low-privilege role entitlements and multi-tenant policy-branch access; enforce least privilege and separation of duties; enable and monitor detailed audit logging for policy-branch and secret-retrieval events; rotate secrets and administrative credentials on exposed branches; and engage CyberArk support for hotfix guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault
The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute
In CyberArk Endpoint Privilege Manager (formerly Viewfinity), Privilege Escalation is possible if the attacker has one p
CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism
In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603, there is persistent XSS via an account name on
CyberArk Identity versions up to and including 22.1 in the 'StartAuthentication' resource, exposes the response header '
CyberArk Password Vault before 9.7 allows remote attackers to obtain sensitive information from process memory by replay
In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the
Unauthorized privilege escalation in CyberArk Endpoint Privilege Manager Agent versions 25.10.0 and earlier allows local
Endpoint Privilege Manager versions up to 25.10.0 is affected by improper privilege management (CVSS 7.8).
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when th
An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Di
GitHub PoC
Exploit-DB