What’s Vulnerable › Vulnerabilities

CVE-2026-45178: Idira Secrets Manager Self-Hosted: Improper Access Control in Internal Cluster Endpoints

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-11 · updated 2026-10-26
• Weakness: CWE-284

Description

Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20

Affected products

• Paloaltonetworks Idira Secrets Manager: from 13.0 before 13.8.1 — fixed in 13.8.1
• Paloaltonetworks Idira Secrets Manager Credential Providers: from 14.0 before 14.2.6 — fixed in 14.2.6
• CyberArk Software, a Palo Alto Networks Company Conjur Enterprise: from 13.0 before 13.8.1 — fixed in 13.8.1

How to fix

Upgrade to a fixed version: Paloaltonetworks Idira Secrets Manager 13.8.1; Paloaltonetworks Idira Secrets Manager Credential Providers 14.2.6; CyberArk Software, a Palo Alto Networks Company Conjur Enterprise 13.8.1. Check the vendor advisory for mitigations.

References

• https://docs.cyberark.com/credential-providers/latest/en/content/landingpages/cp-wn-rn-14.2.6.htm?tocpath=Get%20Started%7CRelease%20notes%7C_____1
• https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.8.1.htm?tocpath=Get%20started%7CRelease%20Notes%7C_____3

Get alerted when CVE-2026-45178 or the next vulnerability affects your stack