CVE-2025-49831 is a critical (CVSS 9.8) authentication flaw in CyberArk Conjur OSS and Secrets Manager, Self-Hosted. If traffic to AWS crosses a misconfigured network device, an attacker can reroute authentication requests to a server they control. Fixed in Conjur OSS 1.22.1 and Secrets Manager, Self-Hosted 13.5.1 and 13.6.1.
What's affected
Per the record, Secrets Manager, Self-Hosted (formerly Conjur Enterprise) before 13.5.1 and 13.6.1, and Conjur OSS before 1.22.1. The fixed releases are Conjur OSS 1.22.1, and Secrets Manager, Self-Hosted 13.5.1 and 13.6.1.
The condition is specific. The record says the issue applies to installations that route traffic from Secrets Manager to AWS through a misconfigured network device. CyberArk states that it believes very few installations are in a state where the issue can be actively exploited. That is the vendor's view, and your own network is the one to examine.
This CVE is a companion to CVE-2025-49827, which covers the same product line and the same fixed versions with a different cause. Treat the two as one upgrade.
How to check if you're exposed
First find the version of each Conjur deployment. For containers:
docker ps --format "{{.Names}} {{.Image}}" | grep -i conjur
Then trace the route from the Conjur server to AWS. Your network team can check for proxies, TLS inspection devices, split tunnels or DNS overrides that sit between Conjur and the AWS endpoints it contacts for IAM validation. The advisory should be checked for the precise conditions.
What to do now
- Upgrade to Conjur OSS 1.22.1, or Secrets Manager, Self-Hosted 13.5.1 or 13.6.1.
- Document the network path between Conjur and AWS, and remove any device that can alter or redirect requests without review.
- Make sure DNS resolution for AWS endpoints from the Conjur hosts is controlled and logged.
- Review authentication logs for unexpected identities.
- Rotate secrets that the affected roles could read if you find signs of misuse.
Why it matters
The weakness is CWE-287, improper authentication. Conjur validates AWS identities by asking AWS to confirm the request. If an attacker can redirect that confirmation call, Conjur ends up asking the wrong party, and takes the answer as proof.
A secrets manager is a high value target, so even a narrow condition matters. The CVSS vector in the record shows a network attack with no privileges and low complexity, and the vendor's note about few exploitable installs explains the gap between that score and real exposure.
Fixing the software is the first step. Controlling what sits between the secrets manager and the services it trusts is the second, because it limits the whole class of redirect problems. The record's KEV flag is false.
Quick check
Does CyberArk say this is widely exploitable?
The record quotes CyberArk as believing there are very few installations where it can be actively exploited. Upgrade anyway, since the fix is available.
What do I check on the network?
Look for proxies, inspection devices or DNS overrides between Conjur and AWS. The advisory has the precise conditions.
Sources
- Gold entry for CVE-2025-49831
- NVD record for CVE-2025-49831
- GitHub advisory GHSA-952q-mjrf-wp5j
- Conjur OSS 1.22.1 release
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in projects you manage.
Last reviewed: 18 October 2026.
