CVE-2026-45165

Severity not reported

Data quality: awaiting analysis. NVD has not completed analysis, so CVSS and affected-product data may be missing or change.

An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch.

An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access controls on the branch or cause a denial of service (DoS). Idira Security Bulletin CA26-38.

CVSS

—

Awaiting analysis by NVD

Timeline (UTC)

Published: 2026-10-15 19:17

Modified: 2026-10-15 21:17

NVD status: Awaiting Analysis

Last synced 1 day ago

Verified against the source API 2026-10-27 07:03 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-863

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/relea... psirt@paloaltonetworks.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:03 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores