Idira Conjur 13.9.0 Authz Flaw Exploits Branch Policy
CVE-2026-45165 Published on October 15, 2026
Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.
Vulnerability Analysis
CVE-2026-45165 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Timeline
Initial publication.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-45165 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-45165
Want to know whenever a new CVE is published for Palo Alto Networks Idira Secrets Manager Self Hosted? stack.watch will email you.
Affected Versions
Palo Alto Networks Idira Secrets Manager (Self-Hosted):- Version 13.9 and below 13.9.1 is affected.