# CyberArk Conjur RCE via Ruby template injection

Source: https://startwithidentity.com/cves/cve-2025-49828/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

Conjur interpolated attacker-influenced data into a Ruby template and executed it. CVSS 8.6. After [CVE-2025-49827](https://startwithidentity.com/cves/cve-2025-49827/) or [CVE-2025-49831](https://startwithidentity.com/cves/cve-2025-49831/) gets you in, this is the RCE. Fixed in Conjur OSS 1.22.1 and Secrets Manager 13.6.1.

## Why it matters

Secrets-manager RCE is game over for every workload secret, every rotation credential, and often the cloud IAM role the manager itself holds. Identity teams own this box even when AppSec files the ticket.

## What to do

- Patch, then rotate. Assume every secret Conjur could read was readable by the attacker during the vulnerable window if the authenticator was reachable.
- Ban user-controlled template rendering in any secrets or policy engine. The same class showed up in [SailPoint transform templates](https://startwithidentity.com/cves/cve-2024-3319/).

## After you patch

A vault compromise is not one credential, it is every credential the vault held or could issue.

- **Rotate everything in scope**, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
- **Revoke active leases and tokens**, then review the audit device log for reads you cannot attribute to a known workload.
- **Rotate the vault's own credentials**: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
- **Rotate downstream credentials the vault brokered**, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See [secrets rotation](https://startwithidentity.com/glossary/secrets-rotation/) and [what is secrets management](https://startwithidentity.com/guides/fundamentals/what-is-secrets-management/).

## Sources

- [NVD: CVE-2025-49828](https://nvd.nist.gov/vuln/detail/CVE-2025-49828)