CVE-2026-45178

HighCVSS 8.1/10Last modified Jun 22, 2026

Description

Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker possessing standard node-level credentials could leverage these endpoints to potentially retrieve unauthorized secrets or cause a denial of service (DoS). CyberArk Security Bulletin: CA26-20

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2026
Last modified: Jun 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-451795.3Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses. If the communication channel to the statsd daemon is n CVE-2026-451807.5Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids. If the communication channel to the statsd daemon is not se CVE-2026-451816.5Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), which allows attackers CVE-2026-451822.2GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClos CVE-2026-451846.5Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.CVE-2026-451859.8Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered CVE-2026-451867.5In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized cr CVE-2026-451876.5Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to CVE-2026-451882.4Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommend CVE-2026-45193.3The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. N CVE-2026-451906.5Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass. In CVE-2026-451916.5Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP