The vulnerability CVE-2026-4387 affects StrongDM Desktop Application on Windows platforms prior to version 23.74.0 (Desktop Client before 53.77.0). It involves cleartext storage of sensitive authentication state data, including JSON Web Tokens and asymmetric key material, in a per-user state file (state.kv) under the user's profile directory. The file is only protected by default NTFS permissions, which means any local user with read access to the profile directory could potentially access these sensitive credentials. Exploitation requires local access and additional deployment conditions. No official patch or remediation level has been published by the vendor as of the provided data.

Exposure of authentication tokens and key material in cleartext could allow an attacker with local read access to the user's profile directory to obtain credentials that may facilitate unauthorized access or impersonation within the StrongDM environment. However, exploitation requires local access and specific conditions, limiting the scope and ease of exploitation. The CVSS score of 2 (low severity) reflects the limited attack vector and complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to user profile directories and ensure NTFS permissions are properly configured to prevent unauthorized read access. Monitor vendor communications for updates regarding patches or official mitigations.