Executive brief
Idira Secrets Manager is a platform used by organizations to securely store and manage sensitive credentials like passwords and API keys. A security flaw in certain versions allows an attacker with basic access to the system's internal network to bypass security controls. This could lead to the unauthorized theft of sensitive corporate secrets or a disruption of the service, potentially impacting business operations and data privacy.
Technical details
A vulnerability classified as improper access control (CWE-284) exists in the internal cluster endpoints of Idira Secrets Manager Self-Hosted. A remote, authenticated attacker with standard node-level credentials can exploit these endpoints due to insufficient validation of access rights. Successful exploitation allows the attacker to retrieve unauthorized secrets from the manager or trigger a denial of service (DoS) condition. The vulnerability affects versions 13.8.0 and earlier; users are advised to upgrade to version 13.8.1 or later to remediate the issue.
Affected products
- Idira (CyberArk) Secrets Manager Self-Hosted 13.8.0 and lower
Timeline
- 2026-06-11: disclosed
- 2026-06-11: advisory
References
- https://docs.cyberark.com/credential-providers/latest/en/content/landingpages/cp-wn-rn-14.2.6.htm?tocpath=Get%20Started%7CRelease%20notes%7C_____1
- https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.8.1.htm?tocpath=Get%20started%7CRelease%20Notes%7C_____3