CVE-2025-49828: conjur — Fix

Description

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secrets or templates into the Secrets Manager, Self-Hosted database could take advantage of an exposed API endpoint to execute arbitrary Ruby code within the Secrets Manager process. This issue affects both Secrets Manager, Self-Hosted (formerly Conjur Enterprise) and Conjur OSS. Conjur OSS version 1.21.2 and Secrets Manager, Self-Hosted version 13.5 fix the issue.

Is your site exposed to CVE-2025-49828?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-1336 CWE-1336

Affected Products

Vendor	Product	Versions
cyberark	conjur	1.20.1 — 1.21.2
cyberark	conjur	13.1 — 13.5

References

Advisories & Patches

https://github.com/cyberark/conjur/security/advisories/GHSA-93hx-v9pv-qrm4

Other References

https://github.com/cyberark/conjur/releases/tag/v1.21.2 http://www.openwall.com/lists/oss-security/2025/07/16/7 http://www.openwall.com/lists/oss-security/2025/08/08/1

Frequently Asked Questions

What is CVE-2025-49828? +

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secrets or templates into the Secrets Manager, Self-Hosted database could take advantage of an exposed API endpoint to execute arbitrary Ruby code within the Secrets Manager process. This issue affects both Secrets Manager, Self-Hosted (formerly Conjur Enterprise) and Conjur OSS. Conjur OSS version 1.21.2 and Secrets Manager, Self-Hosted version 13.5 fix the issue. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2025-49828? +

CVE-2025-49828 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-49828? +

CVE-2025-49828 affects products from cyberark, specifically: conjur. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-49828? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-34300

A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web …

CVE-2026-47727

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe import" filter fails to neutralize …

CVE-2026-77129

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with …

CVE-2026-71871

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression …

CVE-2026-72716