CVE-2026-45165

Executive Summary

CVE-2026-45165 is an authorization flaw (CWE-863) in Idira Conjur version 13.9.0 that allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, the attacker could retrieve unauthorized secrets, modify administrative access controls on the affected branch, or cause a denial of service. The vulnerability has not received a CVSS score or EPSS rating, no public proof-of-concept exists, and no patch has been released as of the latest available intelligence.

Technical Analysis

Idira Conjur is a secrets management platform that uses a policy-as-code model, in which access controls, roles, and permissions are expressed as policy branches organized in a hierarchical structure. Each branch defines who can read, create, update, or delete secrets and administrative access controls within its scope and the scopes of its child branches.

CVE-2026-45165 is classified as CWE-863: Incorrect Authorization. The flaw permits an authenticated but low-privileged user to perform operations on a policy branch that their assigned privileges should forbid. Because Conjur policy branches govern both secret access and the administrative controls that govern the branch itself, an authorization failure at the branch level has a cascading effect: it can expose secrets that reside within the branch, allow tampering with the access controls that define who may administer the branch, or disrupt normal branch operation to the point of denial of service.

The defect is fundamentally an access control enforcement gap rather than a memory-safety, injection, or cryptographic issue. The precise policy evaluation routine, the specific API endpoints, and the exact privilege boundary that is crossed are not disclosed in the NVD description or the referenced Idira Security Bulletin CA26-38. What can be stated with confidence based on the advisory language is:

• The attacker must already hold a valid authenticated account ("authenticated user with limited privileges"). This is therefore a privilege escalation / authorization bypass condition, not an unauthenticated remote compromise.
• The target of the unauthorized action is a "policy branch" — i.e., a defined scope within Conjur's policy hierarchy.
• Exploitation is conditional ("under specific circumstances"), implying that a particular policy configuration, branch state, or request pattern is required to trigger the flaw.

Because the underlying authorization logic is not described publicly, defenders should treat any successful branch-level operation performed by a low-privileged principal as suspicious until Idira clarifies the affected operation set. No implementation-level details (function names, endpoints, parameters) are available and none should be assumed.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the vulnerability class (CWE-863) and the advisory description. No fabricated function names, endpoints, or parameters are asserted.

1. Reconnaissance / target identification. The attacker obtains valid credentials for a low-privileged Conjur identity. This could result from phishing, credential reuse, compromise of a CI/CD service account, or possession of a legitimate but minimally privileged machine identity. Separately, the attacker identifies the target policy branch of interest — for example, the branch that holds high-value secrets or the branch that contains the administrative controls for a sensitive scope.

2. Triggering the authorization flaw. By issuing requests that act on the target policy branch, the attacker takes advantage of the incorrect authorization check. Because CWE-863 is an enforcement gap, the request performs an operation the caller's privileges should not permit; the server fails to reject it. The advisory notes this succeeds only "under specific circumstances," implying a configuration- or state-dependent trigger. The exact trigger is not public.

3. Execution method at the vulnerability-class level. The attacker authenticates normally (T1078 — Valid Accounts) and then submits a branch-scoped operation. The vulnerability class means the operation is not gated by the caller's effective permissions. No specific payload syntax can be provided without the bulletin details.

4. Post-exploitation impact. Three outcomes are described by the advisory:

   • Confidentiality: retrieval of secrets the attacker is not entitled to read (e.g., credentials for downstream systems, API keys, certificates).
   • Integrity / persistence: alteration of administrative access controls on the branch, which could allow the attacker to grant themselves or others durable higher privileges within that scope.
   • Availability: denial of service against the branch, disrupting workloads that depend on it for secret retrieval.

Chained impact: if Conjur secrets protect cloud infrastructure, databases, or CI/CD pipelines, the extracted credentials could be used to pivot into those environments. If administrative controls are altered, remediation becomes harder because the attacker may have modified the very controls used to revoke them.

Impact Assessment

CVSS is not assigned by the supplying data (score: N/A). The following subscores reflect the vulnerability class and advisory language, not an authoritative vendor vector:

• Attack Vector (AV:N): Conjur is administered and consumed over the network/API, so a remote authenticated caller is the expected vector.
• Attack Complexity (AC:H): The advisory states exploitation is possible only "under specific circumstances," indicating a non-trivial precondition (specific branch configuration or state).
• Privileges Required (PR:L): The attacker must already be an authenticated user with limited privileges.
• User Interaction (UI:N): No victim interaction is implied.
• Scope (S:U): Impact remains within the Conjur authorization boundary, though altered admin controls can expand the attacker's effective reach.
• Confidentiality (C:H): Unauthorized secret retrieval is explicitly cited as an outcome; secrets are high-value data.
• Integrity (I:L): Administrative access controls on the branch can be altered.
• Availability (A:L): Denial of service against the branch is cited.

Business impact. Conjur is a central secrets store; compromise of a policy branch can yield credentials that unlock broader infrastructure. The residual risk of altered administrative controls is that the attacker can entrench access even after the initial issue is noticed. Blast radius is bounded by the reach of secrets and service accounts governed by the affected branch and its children. Because no CVSS/EPSS score is available and no exploit is public, prioritization should be driven by the sensitivity of the secrets and access controls in the affected branches rather than by external severity signals.

Detection Guidance

Sigma Rule

title: Idira Conjur Policy Branch Authorization Violation (CVE-2026-45165)
id: 6f2b9c3a-1d4e-4a7b-9c2f-45165cve2026
status: experimental
description: Detects access attempts against Conjur policy branches by low-privileged principals that may indicate exploitation of the CWE-863 authorization flaw.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-45165
author: valtersit.com
date: 2026/01/01
logsource:
  product: conjur
  service: audit
detection:
  selection_action:
    action:
      - 'load_policy'
      - 'update'
      - 'delete'
      - 'create'
      - 'check'
  selection_resource:
    resource|contains: 'policy'
  selection_result:
    result: 'success'
  filter_admin:
    user_role:
      - 'admin'
      - 'policy-admin'
  condition: selection_action and selection_resource and selection_result and not filter_admin
falsepositives:
  - Legitimate delegated branch administrators
level: high
tags:
  - attack.t1078
  - cve.2026.45165

YARA Rule

rule CVE_2026_45165_Conjur_Policy_Branch_Authz
{
    meta:
        description = "Detects references to Conjur policy-branch authorization abuse (CVE-2026-45165)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-45165"
        cve = "CVE-2026-45165"

    strings:
        $a1 = "CVE-2026-45165" ascii nocase
        $a2 = "CA26-38" ascii nocase
        $b1 = "load_policy" ascii nocase
        $b2 = "policy/" ascii nocase
        $c1 = "Conjur" ascii nocase

    condition:
        uint16(0) == 0x5A4D or
        (any of ($b*) and $c1) or
        any of ($a*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-45165 Idira Conjur Policy Branch Unauthorized Action Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/policies/"; nocase; http.header; content:"Authorization"; nocase; threshold:type both, track by_src, count 10, seconds 60; reference:cve,2026-45165; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-45165; classtype:attempted-user; sid:202645165; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" and user.roles : "limited" ]
  [ network where http.request.method in ("PUT", "POST", "DELETE")
    and url.path : "*policy*"
    and event.outcome == "success" ]

Splunk SPL Query

index=conjur sourcetype=conjur:audit
| search action IN ("load_policy","update","delete","create") resource="*policy*" result=success
| eval is_low_priv=if(match(lower(user_role), "admin|policy-admin"), 0, 1)
| where is_low_priv=1
| stats count min(_time) as first_seen max(_time) as last_seen values(resource) as targets by user_name src_ip user_role
| where count > 3
| sort - count
| `comment("CVE-2026-45165 - low-privileged principal performing branch operations")`

Wazuh OSSEC Rule

<group name="conjur,cve-2026-45165,">
  <rule id="202645165" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">load_policy|update|delete|create</field>
    <field name="resource">\.\*policy.*</field>
    <field name="result">success</field>
    <field name="user_role" negate="yes">admin|policy-admin</field>
    <description>CVE-2026-45165: Low-privileged Conjur principal performed policy branch operation - possible authorization bypass</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is provided in the available data. Idira Security Bulletin CA26-38 is the authoritative reference and should be monitored for updates.

1) Immediate mitigations

• Audit all Conjur identities that hold limited, branch-scoped privileges and confirm that each role is truly least-privilege. Reduce the number of principals that can act on sensitive branches.
• Review policy branch structure and remove unnecessary child branches or delegated administrative controls; flattening privilege where possible reduces the attack surface of an authorization bypass.
• Enable and centralize Conjur audit logging, then apply the detection rules above. Pay particular attention to successful branch-scoped operations performed by non-administrative principals.
• Restrict network access to the Conjur API to trusted service networks and administrative hosts.
• Rotate or re-key secrets held in high-value branches as a precaution if suspicious branch operations are observed, and re-check branch administrative controls for unauthorized modification.

2) Patch / upgrade steps

• No patched version is currently identified. Monitor Idira Security Bulletin CA26-38 and the NVD entry for CVE-2026-45165 for the fixed release and applying it as soon as it is available.
• When a fix is released, validate the new version in a staging environment that mirrors production policy branch structure before broad rollout.

3) Long-term hardening

• Adopt a policy of periodic access-control review for all Conjur branches, with automated drift detection between intended and actual branch permissions.
• Enforce strong authentication (short-lived credentials, machine identity scoping) so that a compromised low-privileged account has minimal reach.
• Integrate Conjur audit events into the SIEM with alerting on authorization anomalies, and maintain an inventory of which secrets are governed by which branch to bound blast radius.

References

• NVD — CVE-2026-45165: https://nvd.nist.gov/vuln/detail/CVE-2026-45165
• Idira Security Bulletin CA26-38 (vendor advisory; cited in NVD description — verify availability directly with Idira)
• MITRE CWE-863: Incorrect Authorization — https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1078: Valid Accounts — https://attack.mitre.org/techniques/T1078/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-45165 not listed — CISA KEV: NO)

No exploit code, public PoC, Nuclei template, or exploit-in-the-wild evidence was identified in the available data. No threat actor campaign is associated with CVE-2026-45165 at the time of writing.