Paper/Archive/CVE-2026-45177

CVE-2026-45177

CyberArk Software, a Palo Alto Networks Company Conjur Cloud (Edge Finding only) — Idira Secrets Manager SaaS Edge: Authentication Bypass of an internal validation mechanism

EPSS 0.5%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 43.0.430 × 208.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components. A remote, unauthenticated attacker could exploit this by submitting a specially crafted request. Under specific circumstances, this could allow the attacker to manipulate internal validation mechanisms, potentially leading to a bypass of identity verification and the unauthorized acquisition of an access token. CyberArk Security Bulletin: CA26-20

Affected

ProductAffectedFixed inSource

Conjur Cloud (Edge Finding only)1.0 – < 1.81.8CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

palo_alto (CNA)9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorydocs.cyberark.com/secrets-manager-saas/latest/en/content/conjurcloud/whatsnew.htm#May132026