CVE-2025-49831CyberArk Conjur IAM authenticator bypass via network device
What broke
CVE-2025-49831 is the second IAM-authenticator bypass in the Cyata Conjur chain. A misconfigured network device in front of the authenticator lets an attacker satisfy the AWS identity check. CVSS 9.1. Fixed with CVE-2025-49827 in Conjur OSS 1.22.1 and Secrets Manager 13.6.1.
Why it matters
Two independent ways to fail the same authenticator is the story. Teams that patched only the regex bug and left the network path alone stayed exposed.
What to do
- Take the full Conjur/Secrets Manager upgrade, not a hotfix for 49827 alone.
- Review any appliance or proxy that sits in front of Conjur's IAM authenticator. If it can rewrite the STS conversation, it is in scope.
After you patch
A vault compromise is not one credential, it is every credential the vault held or could issue.
- Rotate everything in scope, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
- Revoke active leases and tokens, then review the audit device log for reads you cannot attribute to a known workload.
- Rotate the vault's own credentials: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
- Rotate downstream credentials the vault brokered, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See secrets rotation and what is secrets management.
Sources
Related identity CVEs
Related on Start with Identity
- CVECyberArk Conjur missing validations, permission bypass
Conjur skipped validations that should have blocked a resource injection and permission bypass. CVSS 6.0. The lowest score in the Cyata set, and still part of t
- CVECyberArk Conjur path traversal and file disclosure
Conjur allowed a path traversal that disclosed files from the host. CVSS 7.1. Useful in the Cyata chain for reading configuration and secrets material after an
- CVECyberArk Conjur RCE via Ruby template injection
Conjur rendered a template in Ruby without isolating attacker input. CVSS 8.6. In the Cyata chain this is the step after the IAM authenticator bypass: from forg
- VendorIdira Secrets Manager (formerly CyberArk Conjur)
strong
- Comparisonaws-secrets-manager-vs-hashicorp-vault
AWS Secrets Manager costs 0.40 dollars per secret per month with nothing to run. Vault has dynamic secrets everywhere and no public price, and you have to opera
- ComparisonHashiCorp Vault vs AWS Secrets Manager vs Doppler
Vault vs AWS Secrets Manager vs Doppler in 2026: IBM's dynamic secrets, AWS at $0.40 per secret a month, Doppler at $21 per user. Pricing, sync and who wins.