CVE-2026-45177 is a critical (CVSS 9.1) improper access control flaw in Idira Secrets Manager SaaS Edge before version 1.8. A remote, unauthenticated request could, under specific conditions, bypass identity checks and yield an access token. Move to 1.8 or later.
What's affected
The record says Idira Secrets Manager SaaS Edge versions prior to 1.8 are affected and ties the issue to CyberArk Security Bulletin CA26-20. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
The CyberArk documentation page in the record did not load when I fetched it, so I could not read the release note itself. Check that page and the bulletin to confirm the fixed build and any customer steps.
How to check if you're exposed
- Find your Secrets Manager SaaS Edge deployments and read their version.
- Compare it with 1.8 using the CyberArk release notes and bulletin CA26-20.
- If the vendor manages the update for your tenant, ask them to confirm in writing.
What to do now
- Update every Edge instance to 1.8 or later.
- Review access token issuance logs for requests you cannot explain.
- If you see suspicious tokens, rotate the secrets and credentials they could reach.
- Limit network exposure of the Edge component where you can.
Why it matters
The weakness is CWE-284, improper access control. A secrets manager guards credentials for other systems, so a token obtained without proof of identity could reach many things. The KEV flag is false.
Quick check
Which versions are fixed?
The record says versions prior to 1.8 are affected. Confirm the exact fixed build in the CyberArk bulletin.
Sources
- CyberArk Secrets Manager SaaS release notes referenced by the record (could not be fetched)
- Gold page for this CVE
Last reviewed: 19 October 2026.
