TI-2026-74981 Aliases CVE-2026-45165

Improper authorization in Idira Secrets Manager REST API

LOW 39CWE-863Published 2026-10-15 · Updated 2026-10-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Palo Alto Networks Idira Secrets Manager (Self-Hosted) from 13.9 before 13.9.1 has an incorrect authorization flaw (CWE-863) in its REST API. An authenticated user with limited privileges can perform unauthorized actions on a policy branch under specific circumstances. Such an attacker could retrieve unauthorized secrets, alter administrative access controls on the branch, or cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00207 10th percentileScored 2026-11-07

Fix Fixed Idira Secrets Manager (Self-Hosted) (Palo Alto Networks): 13.9.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Palo Alto Networks	Idira Secrets Manager (Self-Hosted)	13.9 to before 13.9.1	13.9.1	Patch available	CNA

Idira Secrets Manager (Self-Hosted) VendorPalo Alto Networks Affected 13.9 to before 13.9.1 Fixed in 13.9.1 Patch available CNA

Remediation

Upgrade Idira Secrets Manager (Self-Hosted) to version 13.9.1, which fixes the flaw according to Idira Security Bulletin CA26-38.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Idira Secrets Manager (Self-Hosted) (Palo Alto Networks) Fixed in 13.9.1

Timeline

2026-10-16 Threatist record created from CVE-2026-45165

References

Advisory 1

https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.9.1.htm?tocpath=Get%20started%7CRelease%20Notes%7C_____3

TI-2024-08782 Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure KEVCVSS 4.0CRITICAL 9.9
TI-2024-03172 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect KEVCVSS 3.1CRITICAL 10.0
TI-2020-01936 PAN-OS: Authentication Bypass in SAML Authentication KEVCVSS 3.1CRITICAL 10.0
TI-2017-11675 Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and… KEVCVSS 3.1CRITICAL 9.8
TI-2026-00239 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal KEVCVSS 4.0CRITICAL 9.3
TI-2024-08784 Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure KEVCVSS 4.0CRITICAL 9.2

See all 367 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences