CVE-2026-45177 describes an improper access control vulnerability (CWE-284) in CyberArk Software's Conjur Cloud product, specifically in Idira Secrets Manager SaaS Edge version 1.0. The flaw exists in the internal authentication mechanisms, where an unauthenticated remote attacker can craft requests that manipulate internal validation processes. This manipulation can potentially bypass identity verification and allow the attacker to acquire access tokens without proper authorization. The vulnerability has a CVSS 4.0 base score of 9.1, indicating critical severity. No official remediation or patch information is currently provided, and the product is not a cloud service, so vendor-managed patching is not applicable.

Successful exploitation could lead to unauthorized access token acquisition by unauthenticated remote attackers, effectively bypassing identity verification controls. This could result in unauthorized access to protected resources or systems managed by the affected software. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor CyberArk's security bulletins for updates and apply any forthcoming patches promptly. Until a fix is available, restrict network access to the affected service where possible and apply compensating controls to limit exposure.