CVE-2025-49831

In environments where network traffic from Secrets Manager to AWS is routed through a misconfigured network device (e.g., proxy or router), an attacker can take control of the transmission path and redirect authentication requests to their own malicious server. This server can impersonate the correct AWS endpoint and accept or manipulate authentication requests. The vulnerability is classified as CWE-287 (improper authentication), meaning that the identity verification mechanism can be effectively bypassed without knowledge of valid credentials.

An attacker can gain unauthorized access to the secrets management system, potentially reading or taking control of stored credentials and secrets. The breach of confidentiality and integrity of data stored in the system is high (VC:H, VI:H according to CVSS vector).

Software should be updated to Conjur OSS version 1.22.1 or later and Secrets Manager Self-Hosted to version 13.5.1 or 13.6.1 (or later). Additionally, it is recommended to audit the configuration of network devices handling traffic between Secrets Manager and AWS to detect and eliminate any misconfigurations that enable traffic redirection.

CyberArk Secrets Manager, Self-Hosted (formerly Conjur Enterprise) in versions earlier than 13.5.1 and 13.6.1, and Conjur OSS in versions earlier than 1.22.1. Affects only Self-Hosted installations where traffic to AWS is routed through a misconfigured network device.