CVE-2025-49828

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secrets or templates into the Secrets Manager, Self-Hosted database could take advantage of an exposed API endpoint to execute arbitrary Ruby code within the Secrets Manager process. This issue affects both Secrets Manager, Self-Hosted (formerly Conjur Enterprise) and Conjur OSS. Conjur OSS version 1.21.2 and Secrets Manager, Self-Hosted version 13.5 fix the issue.

• CWE-1336

• https://github.com/cyberark/conjur/releases/tag/v1.21.2Release Notes
• https://github.com/cyberark/conjur/security/advisories/GHSA-93hx-v9pv-qrm4Vendor Advisory
• https://www.openwall.com/lists/oss-security/2025/07/16/7
• https://www.openwall.com/lists/oss-security/2025/08/08/1

Published

Jul 15, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-49822Rejected reason: Not used
• CVE-2025-49823(conda) Constructor is a tool which allows constructing an i…0
• CVE-2025-49824conda-smithy is a tool for combining a conda recipe with con…1.7
• CVE-2025-49825Teleport provides connectivity, authentication, access contr…9.8
• CVE-2025-49826Next.js is a React framework for building full-stack web app…7.5
• CVE-2025-49827Conjur provides secrets management and application identity …9.8
• CVE-2025-49829Conjur provides secrets management and application identity …6.5
• CVE-2025-4983A stored Cross-site Scripting (XSS) vulnerability affecting …8.7
• CVE-2025-49830Conjur provides secrets management and application identity …6.5
• CVE-2025-49831An attacker of Secrets Manager, Self-Hosted installations th…9.8
• CVE-2025-49832Asterisk is an open source private branch exchange and telep…6.5
• CVE-2025-49833GPT-SoVITS-WebUI is a voice conversion and text-to-speech we…9.8