This vulnerability (CVE-2026-45178) affects Conjur Enterprise's Idira Secrets Manager Self-Hosted versions 13.8.0 and lower, where improper access control in internal cluster endpoints could be exploited by a remote attacker who has standard node-level authentication. The attacker could leverage these endpoints to access secrets they are not authorized to retrieve or cause a denial of service. The CVSS 4.0 base score is 8.4, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The vulnerability is categorized under CWE-284 (Improper Access Control). There is no vendor advisory indicating an available patch or fix at this time.

An attacker with standard node-level credentials can remotely exploit this vulnerability to retrieve unauthorized secrets or disrupt service availability via denial of service. This compromises confidentiality and availability of sensitive information managed by Conjur Enterprise. The high CVSS score reflects the significant risk posed by this improper access control issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to internal cluster endpoints to trusted personnel only and monitor for unusual activity involving node-level credentials. Follow CyberArk's security bulletins for updates on remediation.