# CVE-2026-45178: Idira Secrets Manager improper access control in cluster endpoints

Source: https://junglewise.ai/threats/cve-2026-45178-idira-secrets-manager-improper-access-control-in-cluster  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-45178 · Severity: info · CVSS 8.4 · Published 2026-06-11

Idira Secrets Manager is a platform used by organizations to securely store and manage sensitive credentials like passwords and API keys. A security flaw in certain versions allows an attacker with basic access to the system's internal network to bypass security controls. This could lead to the unauthorized theft of sensitive corporate secrets or a disruption of the service, potentially impacting business operations and data privacy.

Vendors: [CyberArk](https://junglewise.ai/threats/vendors/cyberark).

## Quick answers

**Is CVE-2026-45178 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45178 being exploited in the wild.

**How severe is CVE-2026-45178?** Informational severity, with a CVSS score of 8.4, published 11 June 2026.

**Which products and versions are affected?** CyberArk Secrets Manager Self-Hosted 13.8.0 and lower.

**Is there a fix for CVE-2026-45178?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45178 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45178?** Check whether you run CyberArk Secrets Manager Self-Hosted at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as improper access control (CWE-284) exists in the internal cluster endpoints of Idira Secrets Manager Self-Hosted. A remote, authenticated attacker with standard node-level credentials can exploit these endpoints due to insufficient validation of access rights. Successful exploitation allows the attacker to retrieve unauthorized secrets from the manager or trigger a denial of service (DoS) condition. The vulnerability affects versions 13.8.0 and earlier; users are advised to upgrade to version 13.8.1 or later to remediate the issue.

## Affected products

- Idira (CyberArk) Secrets Manager Self-Hosted 13.8.0 and lower

## Timeline

- 2026-06-11: disclosed
- 2026-06-11: advisory

## References

- [https://docs.cyberark.com/credential-providers/latest/en/content/landingpages/cp-wn-rn-14.2.6.htm?tocpath=Get%20Started%7CRelease%20notes%7C_____1](https://docs.cyberark.com/credential-providers/latest/en/content/landingpages/cp-wn-rn-14.2.6.htm?tocpath=Get%20Started%7CRelease%20notes%7C_____1)
- [https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.8.1.htm?tocpath=Get%20started%7CRelease%20Notes%7C_____3](https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.8.1.htm?tocpath=Get%20started%7CRelease%20Notes%7C_____3)