EUVD-2026-36296
GHSA-gvf5-9x7p-qfqc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain node-level credentials
-
DeliveryReach internal cluster endpoint
-
ExploitAuthenticate as standard node
-
ExecutionInvoke privileged cluster operation
-
ImpactExfiltrate unauthorized secrets or trigger DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must possess valid standard node-level credentials for the Conjur Enterprise cluster and have network reachability to the internal cluster endpoints, which are normally meant for node-to-node traffic; no user interaction is needed (UI:N) and complexity is low (AC:L/AT:N). Exploitation is limited to deployments running Idira Secrets Manager Self-Hosted / Conjur Enterprise 13.8.0 or earlier, and is gated by whoever can present node-level credentials - meaning hardened deployments that segment cluster traffic onto a private node network and tightly control node-credential issuance materially reduce reachability. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L gives a base score of 8.4, driven by network reachability, low complexity, and high confidentiality impact that propagates to subsequent systems - fitting for a secrets manager whose downstream consumers inherit any leaked credential. PR:L is the decisive constraint: an attacker must already hold valid node-level credentials, which limits the realistic threat to insiders, compromised cluster members, or attackers who have already gained an initial foothold in the Conjur infrastructure. No EPSS, KEV, SSVC, or POC data was supplied; CISA KEV listing is absent and no public exploit identified at time of analysis, so this should be treated as a high-impact-but-precondition-bound issue rather than a mass-exploitation candidate. The U:Amber CISA-ADP tag suggests CyberArk views this as significant enough to warrant coordinated disclosure but not as an emergency, which aligns with the authenticated-attacker prerequisite. |
| Exploit ScenarioDerived | An attacker who has obtained a standard Conjur node-level credential - for example by compromising a misconfigured cluster member or extracting credentials from a backup - sends authenticated requests directly to internal cluster endpoints rather than the user-facing API. By doing so they pull secrets they were never authorized to read and/or hammer the endpoints to degrade cluster availability, downstream impacting every application that relies on Conjur for runtime credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 11, 2026
Improper access control in CyberArk Conjur Enterprise (Idira Secrets Manager Self-Hosted) versions 13.8.0 and earlier allows authenticated attackers with standard node-level credentials to abuse internal cluster endpoints to retrieve unauthorized secrets or trigger denial of service. The flaw is rated CVSS 4.0 base 8.4 with high confidentiality impact extending to subsequent systems, but no public exploit identified at time of analysis. CyberArk has published Security Bulletin CA26-20 alongside fixed releases.
RemediationAI
Upgrade Conjur Enterprise / Secrets Manager Self-Hosted to version 13.8.1 or later as identified by CyberArk Security Bulletin CA26-20 and the 13.8.1 release notes at https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.8.1.htm; operators running the Credential Providers stack should also review the 14.2.6 advisory at https://docs.cyberark.com/credential-providers/latest/en/content/landingpages/cp-wn-rn-14.2.6.htm to align component versions. Until patching is complete, restrict network reachability of the internal cluster endpoints to the Conjur node mesh only using firewall or security-group rules, segment the cluster onto a dedicated management network unreachable from application tiers, and rotate any node-level credentials suspected of exposure - note that overly aggressive segmentation can disrupt cluster replication and HA failover, so changes should be staged. Monitoring node-credential authentication patterns and access to cluster-internal routes for anomalous use is a reasonable compensating control while change windows are scheduled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is CyberArk Conjur Enterprise (rebranded under the Idira Secrets Manager Self-Hosted line), a clustered secrets-management platform that brokers credentials, API keys, and certificates for applications and infrastructure. The flaw is classified as CWE-284 (Improper Access Control) and resides in internal cluster endpoints - interfaces intended for node-to-node coordination within a Conjur deployment. These endpoints apparently fail to enforce role separation between standard node identities and privileged cluster operations, letting any holder of node-level credentials reach functionality that should be restricted to the cluster control plane. The CPE data lists multiple wildcard cpe:2.3:a:cyberark_software,_a_palo_alto_networks_company:conjur_enterprise entries, confirming the Conjur Enterprise codebase as the impacted asset.
Know when Conjur Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/U:Amber
Network-reachable internal endpoint with low complexity; PR:L because standard node credentials are required; scope changes as a compromised node exposes secrets governing other systems, with high confidentiality and partial availability impact.
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
1DescriptionCVE.org
Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20
Executive ViewAI
CyberArk Conjur Enterprise versions 13.8.0 and earlier contain an access control flaw allowing standard-level users to retrieve secrets they are not authorized to access, with potential to expose credentials across dependent applications and systems. No public exploit code has been identified at this time. Patched versions are available from the vendor and should be prioritized.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB