CVE-2025-49828: cyberark conjur

Vulnerability summary

CVE-2025-49828 is a high (CVSS 8.8) vulnerability in cyberark conjur. EPSS estimates a 2.24% chance of exploitation in the next 30 days, higher than 82.6% of scored vulnerabilities.

Timeline

1. 15-07-2025
   PublishedVulnerability first disclosed.
2. 04-11-2025
   Last modifiedVulnerability information updated.

Description

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secrets or templates into the Secrets Manager, Self-Hosted database could take advantage of an exposed API endpoint to execute arbitrary Ruby code within the Secrets Manager process. This issue affects both Secrets Manager, Self-Hosted (formerly Conjur Enterprise) and Conjur OSS. Conjur OSS version 1.21.2 and Secrets Manager, Self-Hosted version 13.5 fix the issue.

• CWE-1336Improper Neutralization of Special Elements Used in a Template EngineThe product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.