{"api_version":"1","generated_at":"2026-06-21T05:39:38+00:00","cve":"CVE-2026-45178","urls":{"html":"https://cve.report/CVE-2026-45178","api":"https://cve.report/api/cve/CVE-2026-45178.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-45178","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-45178"},"summary":{"title":"Idira Secrets Manager Self-Hosted: Improper Access Control in Internal Cluster Endpoints","description":"Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20","state":"PUBLISHED","assigner":"palo_alto","published_at":"2026-06-11 19:16:42","updated_at":"2026-06-11 20:56:29"},"problem_types":["CWE-284","CWE-284 CWE-284: Improper Access Control"],"metrics":[{"version":"4.0","source":"psirt@paloaltonetworks.com","type":"Secondary","score":"8.4","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"AMBER"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"8.4","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/U:Amber","data":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.4,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}}],"references":[{"url":"https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.8.1.htm?tocpath=Get%20started%7CRelease%20Notes%7C_____3","name":"https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.8.1.htm?tocpath=Get%20started%7CRelease%20Notes%7C_____3","refsource":"psirt@paloaltonetworks.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://docs.cyberark.com/credential-providers/latest/en/content/landingpages/cp-wn-rn-14.2.6.htm?tocpath=Get%20Started%7CRelease%20notes%7C_____1","name":"https://docs.cyberark.com/credential-providers/latest/en/content/landingpages/cp-wn-rn-14.2.6.htm?tocpath=Get%20Started%7CRelease%20notes%7C_____1","refsource":"psirt@paloaltonetworks.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45178","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45178","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"CyberArk Software, a Palo Alto Networks Company","product":"Conjur Enterprise","version":"affected 13.0 13.8.1 custom","platforms":["Idira Secrets Manager"]},{"source":"CNA","vendor":"CyberArk Software, a Palo Alto Networks Company","product":"Conjur Enterprise","version":"affected 14.0 14.2.6 custom","platforms":["Central Credential Provider (CCP)"]},{"source":"CNA","vendor":"CyberArk Software, a Palo Alto Networks Company","product":"Conjur Enterprise","version":"affected 14.0 14.2.6 custom","platforms":["z/OS Credential Provider"]},{"source":"CNA","vendor":"CyberArk Software, a Palo Alto Networks Company","product":"Conjur Enterprise","version":"affected 14.0 14.2.6 custom","platforms":["Credential Provider (CP)"]}],"timeline":[{"source":"CNA","time":"2026-06-11T17:10:00.000Z","lang":"en","value":"Initial publication."}],"solutions":[{"source":"CNA","title":"","value":"VERSION                                                  MINOR VERSION         SUGGESTED SOLUTION\nConjur Enterprise on Idira Secrets Manager               13.0 through 13.8.0   Upgrade to 13.8.1 or later.\nConjur Enterprise on Central Credential Provider (CCP)   14.0 through 14.2.5   Upgrade to 14.2.6 or later.\nConjur Enterprise on z/OS Credential Provider            14.0 through 14.2.5   Upgrade to 14.2.6 or later.\nConjur Enterprise on Credential Provider (CP)            14.0 through 14.2.5   Upgrade to 14.2.6 or later.","time":"","lang":"eng"}],"workarounds":[],"exploits":[{"source":"CNA","title":"","value":"Palo Alto Networks is not aware of any malicious exploitation of this issue.","time":"","lang":"en"}],"credits":[{"source":"CNA","value":"Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"45178","cve":"CVE-2026-45178","epss":"0.003230000","percentile":"0.238860000","score_date":"2026-06-18","updated_at":"2026-06-19 00:08:13"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-45178","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-06-11T19:04:30.637534Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-06-11T19:04:56.256Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["Idira Secrets Manager"],"product":"Conjur Enterprise","vendor":"CyberArk Software, a Palo Alto Networks Company","versions":[{"changes":[{"at":"13.8.1","status":"unaffected"}],"lessThan":"13.8.1","status":"affected","version":"13.0","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Central Credential Provider (CCP)"],"product":"Conjur Enterprise","vendor":"CyberArk Software, a Palo Alto Networks Company","versions":[{"changes":[{"at":"14.2.6","status":"unaffected"}],"lessThan":"14.2.6","status":"affected","version":"14.0","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["z/OS Credential Provider"],"product":"Conjur Enterprise","vendor":"CyberArk Software, a Palo Alto Networks Company","versions":[{"changes":[{"at":"14.2.6","status":"unaffected"}],"lessThan":"14.2.6","status":"affected","version":"14.0","versionType":"custom"}]},{"defaultStatus":"unaffected","platforms":["Credential Provider (CP)"],"product":"Conjur Enterprise","vendor":"CyberArk Software, a Palo Alto Networks Company","versions":[{"changes":[{"at":"14.2.6","status":"unaffected"}],"lessThan":"14.2.6","status":"affected","version":"14.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cyberark_software_a_palo_alto_networks_company:conjur_enterprise:*:*:idira_secrets_manager:*:*:*:*:*","versionEndExcluding":"13.8.1","versionStartIncluding":"13.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:cyberark_software_a_palo_alto_networks_company:conjur_enterprise:*:*:central_credential_provider_ccp_:*:*:*:*:*","versionEndExcluding":"14.2.6","versionStartIncluding":"14.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:cyberark_software_a_palo_alto_networks_company:conjur_enterprise:*:*:z_os_credential_provider:*:*:*:*:*","versionEndExcluding":"14.2.6","versionStartIncluding":"14.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:cyberark_software_a_palo_alto_networks_company:conjur_enterprise:*:*:credential_provider_cp_:*:*:*:*:*","versionEndExcluding":"14.2.6","versionStartIncluding":"14.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"finder","value":"Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue"}],"datePublic":"2026-06-11T17:10:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20"}],"value":"Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20"}],"exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Palo Alto Networks is not aware of any malicious exploitation of this issue."}],"value":"Palo Alto Networks is not aware of any malicious exploitation of this issue."}],"impacts":[{"capecId":"CAPEC-130","descriptions":[{"lang":"en","value":"CAPEC-130 Excessive Allocation"}]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.4,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"AMBER","subAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284: Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-06-11T18:19:08.100Z","orgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","shortName":"palo_alto"},"references":[{"tags":["vendor-advisory"],"url":"https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.8.1.htm?tocpath=Get%20started%7CRelease%20Notes%7C_____3"},{"tags":["vendor-advisory"],"url":"https://docs.cyberark.com/credential-providers/latest/en/content/landingpages/cp-wn-rn-14.2.6.htm?tocpath=Get%20Started%7CRelease%20notes%7C_____1"}],"solutions":[{"lang":"eng","supportingMedia":[{"base64":false,"type":"text/html","value":"<table class=\"tbl\"><thead><tr><th>Version<br></th><th>Minor Version<br></th><th>Suggested Solution<br></th></tr></thead><tbody><tr>\n                                    <td>Conjur Enterprise on Idira Secrets Manager<br></td>\n                                    <td>13.0 through 13.8.0</td>\n                                    <td>Upgrade to 13.8.1 or later.</td>\n                                </tr><tr><td>Conjur Enterprise on Central Credential Provider (CCP)</td><td>14.0 through 14.2.5</td><td>Upgrade to 14.2.6 or later.</td></tr><tr><td>Conjur Enterprise on z/OS Credential Provider</td><td>14.0 through 14.2.5</td><td>Upgrade to 14.2.6 or later.</td></tr><tr><td>Conjur Enterprise on Credential Provider (CP)</td><td>14.0 through 14.2.5</td><td>Upgrade to 14.2.6 or later.</td></tr></tbody></table>"}],"value":"VERSION                                                  MINOR VERSION         SUGGESTED SOLUTION\nConjur Enterprise on Idira Secrets Manager               13.0 through 13.8.0   Upgrade to 13.8.1 or later.\nConjur Enterprise on Central Credential Provider (CCP)   14.0 through 14.2.5   Upgrade to 14.2.6 or later.\nConjur Enterprise on z/OS Credential Provider            14.0 through 14.2.5   Upgrade to 14.2.6 or later.\nConjur Enterprise on Credential Provider (CP)            14.0 through 14.2.5   Upgrade to 14.2.6 or later."}],"source":{"discovery":"INTERNAL"},"timeline":[{"lang":"en","time":"2026-06-11T17:10:00.000Z","value":"Initial publication."}],"title":"Idira Secrets Manager Self-Hosted: Improper Access Control in Internal Cluster Endpoints","x_generator":{"engine":"Vulnogram 0.1.0-dev"}}},"cveMetadata":{"assignerOrgId":"d6c1279f-00f6-4ef7-9217-f89ffe703ec0","assignerShortName":"palo_alto","cveId":"CVE-2026-45178","datePublished":"2026-06-11T18:19:08.100Z","dateReserved":"2026-05-08T23:01:00.502Z","dateUpdated":"2026-06-11T19:04:56.256Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-06-11 19:16:42","lastModifiedDate":"2026-06-11 20:56:29","problem_types":["CWE-284","CWE-284 CWE-284: Improper Access Control"],"metrics":{"cvssMetricV40":[{"source":"psirt@paloaltonetworks.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"AMBER"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"45178","Ordinal":"1","Title":"Idira Secrets Manager Self-Hosted: Improper Access Control in In","CVE":"CVE-2026-45178","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"45178","Ordinal":"1","NoteData":"Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20","Type":"Description","Title":"Idira Secrets Manager Self-Hosted: Improper Access Control in In"}]}}}