High severity · published Jun 11, 2026
CVE-2026-45178
Idira Secrets Manager Self-Hosted: Improper Access Control in Internal Cluster Endpoints
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Conjur Enterprise · CyberArk Software, a Palo Alto Networks Company
13.0 before 13.8.1; 14.0 before 14.2.6; 14.0 before 14.2.6; 14.0 before 14.2.6 · source: vendor
IS
Idira Secrets Manager · Paloaltonetworks
13.0 before 13.8.1 · source: NVD
IS
Idira Secrets Manager Credential Providers · Paloaltonetworks
14.0 before 14.2.6 · source: NVD
Affected product
CE
Conjur Enterprise
CyberArk Software, a Palo Alto Networks Company
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45178
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45178
Release Notes
https://docs.cyberark.com/credential-providers/latest/en/content/landingpages/cp-wn-rn-14.2.6.htm?tocpath=Get%20Started%7CRelease%20notes%7C_____1
Release Notes
https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.8.1.htm?tocpath=Get%20started%7CRelease%20Notes%7C_____3