Start with Identity
Subscribe
Identity CVE · Secrets managers

CVE-2025-49827CyberArk Conjur IAM authenticator bypass via malformed regex

critical · CVSS 9.1
Product: CyberArk Conjur / Secrets ManagerVendor: CyberArkCWE-807Disclosed: 2025-07-15Status: PatchedNVD ↗

What broke

CyberArk Conjur authenticates AWS workloads by validating an STS identity. A malformed regex in that authenticator redirected the validation to a server the attacker controlled (CWE-807, reliance on untrusted inputs in a security decision). CVSS 9.1. Cyata disclosed five Conjur CVEs at Black Hat USA 2025 (published 19 June / 15 July 2025). Chained, they become unauthenticated RCE. Fixed in Conjur OSS 1.22.1 and Secrets Manager 13.5.1 / 13.6.1. No known in-the-wild exploitation at disclosure.

Why it matters

A secrets manager is an identity provider for machines. Bypass the IAM authenticator and you do not steal one secret. You become every workload that Conjur would have handed credentials to. This is the secrets-plane equivalent of CVE-2025-55241.

What to do

  • Upgrade Conjur OSS to 1.22.1+ or Secrets Manager to 13.6.1+. Take all five CVEs in one change.
  • Rotate every secret Conjur held. A bypass means you cannot trust what was checked out.
  • Pin the STS endpoint. Do not let authenticator config supply the host you validate against.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.