Which versions of Conjur Enterprise are affected by CVE-2026-45178?

CyberArk Conjur Enterprise versions 13.8.0 and earlier contain an access control flaw allowing standard-level users to retrieve secrets they are not authorized to access, with potential to expose…. A patch is available.

How to fix or mitigate CVE-2026-45178?

Within 24 hours: Inventory all CyberArk Conjur Enterprise installations and identify those running version 13.8.0 or earlier; implement enhanced monitoring of secret access patterns. Within 7 days: Apply vendor patches per Security Bulletin CA26-20 to all affected systems and audit recent access logs for unauthorized secret retrieval. Within 30 days: Complete patching across entire environment and conduct full secrets audit to identify any compromised credentials.

Conjur Enterprise CVE-2026-45178

Q: What is the CVSS score of CVE-2026-45178?

CVE-2026-45178 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber. EPSS exploitation probability: 0.1%.

EUVD-2026-36296 HIGH

Improper Access Control (CWE-284)

2026-06-11 palo_alto

GHSA-gvf5-9x7p-qfqc

Authentication Bypass Denial Of Service Conjur Enterprise

8.4

CVSS 4.0 · Vendor: palo_alto

Severity by source

Vendor (palo_alto) PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

vuln.today AI

8.5 HIGH

Network-reachable internal endpoint with low complexity; PR:L because standard node credentials are required; scope changes as a compromised node exposes secrets governing other systems, with high confidentiality and partial availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L

Primary rating from Vendor (palo_alto).

CVSS VectorVendor: palo_alto

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 11, 2026 - 20:01 EUVD

Analysis Generated

Jun 11, 2026 - 19:16 vuln.today

DescriptionCVE.org

Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20

AnalysisAI

Improper access control in CyberArk Conjur Enterprise (Idira Secrets Manager Self-Hosted) versions 13.8.0 and earlier allows authenticated attackers with standard node-level credentials to abuse internal cluster endpoints to retrieve unauthorized secrets or trigger denial of service. The flaw is rated CVSS 4.0 base 8.4 with high confidentiality impact extending to subsequent systems, but no public exploit identified at time of analysis. CyberArk has published Security Bulletin CA26-20 alongside fixed releases.

Technical ContextAI

The affected product is CyberArk Conjur Enterprise (rebranded under the Idira Secrets Manager Self-Hosted line), a clustered secrets-management platform that brokers credentials, API keys, and certificates for applications and infrastructure. The flaw is classified as CWE-284 (Improper Access Control) and resides in internal cluster endpoints - interfaces intended for node-to-node coordination within a Conjur deployment. These endpoints apparently fail to enforce role separation between standard node identities and privileged cluster operations, letting any holder of node-level credentials reach functionality that should be restricted to the cluster control plane. The CPE data lists multiple wildcard cpe:2.3:a:cyberark_software,_a_palo_alto_networks_company:conjur_enterprise entries, confirming the Conjur Enterprise codebase as the impacted asset.

RemediationAI

Upgrade Conjur Enterprise / Secrets Manager Self-Hosted to version 13.8.1 or later as identified by CyberArk Security Bulletin CA26-20 and the 13.8.1 release notes at https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.8.1.htm; operators running the Credential Providers stack should also review the 14.2.6 advisory at https://docs.cyberark.com/credential-providers/latest/en/content/landingpages/cp-wn-rn-14.2.6.htm to align component versions. Until patching is complete, restrict network reachability of the internal cluster endpoints to the Conjur node mesh only using firewall or security-group rules, segment the cluster onto a dedicated management network unreachable from application tiers, and rotate any node-level credentials suspected of exposure - note that overly aggressive segmentation can disrupt cluster replication and HA failover, so changes should be staged. Monitoring node-credential authentication patterns and access to cluster-internal routes for anomalous use is a reasonable compensating control while change windows are scheduled.