Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components. A remote, unauthenticated attacker could exploit this by submitting a specially crafted request. Under specific circumstances, this could allow the attacker to manipulate internal validation mechanisms, potentially leading to a bypass of identity verification and the unauthorized acquisition of an access token. CyberArk Security Bulletin: CA26-20
In plain language
Written by AI from the record
If you use Idira Secrets Manager SaaS Edge (or Conjur Cloud Edge), versions before 1.8 have a flaw that lets an attacker bypass login checks and obtain an access token—this is serious and you should update.
In Idira Secrets Manager SaaS Edge (and Conjur Cloud Edge finding only) prior to 1.8, there is an authentication bypass driven by improper access control in internal authentication components that a remote, unauthenticated attacker can trigger via a specially crafted request to obtain an access token.
If you're affected
Unauthorized access to secrets
Access token theft or abuse
Account takeover risk
Service disruption not expected
What is it
Think of your secrets manager edge as a locked front door for applications. This bug is like a hole in the door’s internal “are you who you say you are?” check—without needing a login, an attacker could craft a request that slips past and grabs a token that lets them act as if they were authenticated. That token can then be used to access what the secrets manager is protecting.
Who is affected
This matters if your business uses Idira Secrets Manager SaaS Edge (and/or Conjur Cloud’s edge component as identified in the Edge finding) and you are on a version earlier than 1.8. The key risk is that an attacker does not need a login or user interaction to try the bypass. How likely it is depends on whether the vulnerable edge is reachable from the attacker and exposed in your environment (default reachability isn’t confirmed in the findings).
How urgent is it
Treat this as urgent because a public exploit exists, meaning attackers can potentially use it without much work. While CISA KEV does not list it, the ability to bypass authentication and obtain an access token makes this a direct pathway to compromise. With an AMBER verdict, prioritize updating to 1.8 as soon as possible.
What to do — in detail
Confirm what you run:
Identify your deployment of Idira Secrets Manager SaaS Edge and the version number.
If you also use Conjur Cloud’s edge component (Edge finding only), confirm that edge version/level is aligned with your Idira/Conjur edge deployment.
Determine exposure:
Vulnerable if the edge is “prior to 1.8.”
The attack does not require login or user interaction (per findings), so focus on whether the edge endpoint can be reached from an attacker’s network path.
Upgrade to the fixed version:
Upgrade Idira Secrets Manager SaaS Edge to fixed version 1.8 (or later).
If applicable, ensure Conjur Cloud (Edge finding only) is updated/fixed to 1.8 as well.
Validate after upgrade:
Re-check the running version of the edge component is now 1.8.
Confirm normal authentication flows still work for legitimate clients.
Temporary containment if patching is delayed:
Restrict network access to the edge component so it is not reachable from untrusted networks.
Ensure only your approved networks/IPs (and your applications’ traffic paths) can reach the edge endpoint. (The findings do not confirm whether reachability is default; the safest short-term mitigation is reducing exposure.)
What to monitor:
Look for unusual authentication/token issuance activity (unexpected tokens being created/used).
Review access logs around the edge for repeated requests that match abnormal patterns, especially from unexpected sources.
Reporting:
If you suspect compromise, treat any obtained access token as potentially hostile and rotate/revoke as your system’s procedures require, then audit secret access by the affected identities.
Technical context
Severity/impact: The weakness is CWE-284 (Improper Access Control). The finding states a remote, unauthenticated attacker can bypass internal validation mechanisms to obtain an access token in Idira Secrets Manager SaaS Edge versions prior to 1.8.
Attack vector/mechanism: Attackers send a specially crafted request to the edge component that bypasses identity verification in its internal authentication components, resulting in unauthorized access via token acquisition.
Exploitation status: A public exploit is available. KEV is not listed in CISA KEV, and there’s rising press attention, but exploitation likelihood is not confirmed via KEV/news in the provided findings.
Fix: The vulnerability is fixed in idira secrets manager edge version 1.8 and Conjur Cloud (Edge finding only) fixed in 1.8.
EPSS note: A prediction is provided (trend flat), but this should not be relied on for prioritization compared to the existence of a public exploit.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
