CVE-2025-49829: Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations

Medium severity · published Jul 15, 2025

CVE-2025-49829

Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations

6.5

CVSS

0.5%

EPSS

On KEV

Description

Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager, Self-Hosted allows authenticated attackers to inject resources into the database and to bypass permission checks. This issue affects Secrets Manager, Self-Hosted (formerly Conjur Enterprise) prior to versions 13.5.1 and 13.6.1 and Conjur OSS prior to version 1.22.1. Conjur OSS version 1.22.1 and Secrets Manager, Self-Hosted versions 13.5.1 and 13.6.1 fix the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 39% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

conjur · cyberark

Conjur OSS < 1.22.1; Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) < 13.5.1; Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) = 13.6 · source: vendor, NVD

Affected product

conjur

cyberark

All conjur CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-49829

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-49829

Release Notes

https://github.com/cyberark/conjur/releases/tag/v1.22.1

Vendor Advisory

https://github.com/cyberark/conjur/security/advisories/GHSA-9w76-m74g-4c2r

www.openwall.com

http://www.openwall.com/lists/oss-security/2025/07/16/7

www.openwall.com

http://www.openwall.com/lists/oss-security/2025/08/08/1