Vulnerability Details CVE-2026-45178
Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 27.9%
CVSS Severity
CVSS v3 Score 8.1
References
- https://docs.cyberark.com/credential-providers/latest/en/content/landingpages/cp-wn-rn-14.2.6.htm?tocpath=Get%20Started%7CRelease%20notes%7C_____1
- https://docs.cyberark.com/secrets-manager-sh/13.9/en/content/enterprise/releasenotes/release-notes-13.8.1.htm?tocpath=Get%20started%7CRelease%20Notes%7C_____3
Products affected by CVE-2026-45178
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.0
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.0.1
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.0.2
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.0.3
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.0.4
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.1
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.2
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.2.1
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.3
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.3.2
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.3.3
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.4
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.4.1
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.5
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.6
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.6.1
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.6.2
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.6.3
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.7
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager:13.8
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager_credential_providers:14.0
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager_credential_providers:14.0.1
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager_credential_providers:14.2
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager_credential_providers:14.2.1
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager_credential_providers:14.2.2
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager_credential_providers:14.2.3
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager_credential_providers:14.2.4
-
cpe:2.3:a:paloaltonetworks:idira_secrets_manager_credential_providers:14.2.5