CVE-2026-45165
8.6HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-863
Impact
Authenticated low-privileged users can retrieve unauthorized secrets, modify policy branch access controls, or cause a denial of service. The attacker needs valid network access and basic user credentials in Conjur.
Root cause
An incorrect authorization check allows users with restricted permissions to execute unauthorized actions against policy branches.
Affected systems
Idira Conjur 13.9.0
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:M/U:Amber
Fix & remediation
Upgrade to Idira Conjur 13.9.1 or later. No interim mitigation is provided; restrict untrusted user access to the Conjur interface until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.