TI-2026-03815 Aliases CVE-2026-4387 GHSA-qgjm-4mg2-6wm5

Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file

LOW 10CWE-312Published 2026-05-29 · Updated 2026-06-01

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-312.

Summary

StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\<username>\.sdm\state.kv. The file is protected only by default user-level NTFS permissions. Exploitation requires local read access to the affected user's profile directory and additional deployment and execution conditions on the target host. The condition was reported through coordinated disclosure by Hope Walker (SpecterOps).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00132 2nd percentileScored 2026-11-07

Fix Fixed StrongDM Desktop Application (StrongDM): 23.74.0StrongDM Desktop Client (StrongDM): 53.77.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
StrongDM	StrongDM Desktop Application	before 23.74.0	23.74.0	Patch available	CNA
StrongDM	StrongDM Desktop Client	before 53.77.0	53.77.0	Patch available	CNA

StrongDM Desktop Application VendorStrongDM Affected before 23.74.0 Fixed in 23.74.0 Patch available CNA
StrongDM Desktop Client VendorStrongDM Affected before 53.77.0 Fixed in 53.77.0 Patch available CNA

Remediation

Fix · CNA StrongDM Desktop Application (StrongDM) Fixed in 23.74.0
Fix · CNA StrongDM Desktop Client (StrongDM) Fixed in 53.77.0

Timeline

2026-10-02 Threatist record created from CVE-2026-4387
2026-10-03 Alias added: GHSA-qgjm-4mg2-6wm5

References

Advisory 1

StrongDM Security Advisory

Other 1

https://specterops.io/blog/2026/06/01/cve-2026-4387-strongdm-state-file-reuse/

TI-2025-05590 OS command injection in StrongDM sdm-cli CVSS 4.0HIGH 8.5
TI-2025-05591 Root Certificate Injection CVSS 4.0HIGH 8.5
TI-2025-05589 Authentication Hijack CVSS 4.0HIGH 8.5
TI-2025-05592 Configd Injection CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences