CVE-2025-49829CyberArk Conjur missing validations, permission bypass
What broke
Conjur did not validate a resource identifier tightly enough. An authenticated (or, in the chain, forged) caller could inject a resource and skip a permission check. CVSS 6.0. Fixed in the same 1.22.1 / 13.6.1 train.
Why it matters
A "medium" authorization bug is how a forged machine identity from CVE-2025-49827 becomes a policy write, which becomes template injection. Score the chain, not the CWE in isolation.
What to do
- Upgrade with the rest of the Cyata set.
- Review Conjur policy for unexpected resource IDs created in mid-2025 if the authenticator was internet-reachable.
After you patch
A vault compromise is not one credential, it is every credential the vault held or could issue.
- Rotate everything in scope, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
- Revoke active leases and tokens, then review the audit device log for reads you cannot attribute to a known workload.
- Rotate the vault's own credentials: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
- Rotate downstream credentials the vault brokered, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See secrets rotation and what is secrets management.
Sources
Related identity CVEs
Related on Start with Identity
- CVECyberArk Conjur IAM authenticator bypass via network device
A second Conjur IAM-authenticator bypass, this time through a misconfigured network device. CVSS 9.1. Same Cyata chain as CVE-2025-49827.
- CVECyberArk Conjur path traversal and file disclosure
Conjur allowed a path traversal that disclosed files from the host. CVSS 7.1. Useful in the Cyata chain for reading configuration and secrets material after an
- Comparisonaws-secrets-manager-vs-hashicorp-vault
This is the classic build-on-the-cloud versus run-a-platform decision. AWS Secrets Manager is a fully managed service that stores and rotates secrets with deep,
- ComparisonHashiCorp Vault vs AWS Secrets Manager vs Doppler
These three secrets managers sit at different points on the control-versus-convenience spectrum. HashiCorp Vault is a portable platform with the deepest dynamic
- Comparisonhashicorp-vault-vs-cyberark-conjur
Both manage secrets, but they come from different worlds. HashiCorp Vault is the de facto secrets platform for cloud-native and platform-engineering teams, buil
- VendorAWS Secrets Manager
strong