CVE-2025-49828 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Execution

High 8.6 Published 15 Jul 2025 Updated 4 Nov 2025

An authenticated attacker can execute arbitrary Ruby code by injecting secrets or templates into the Conjur Secrets Manager database via an exposed API endpoint.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-49828?

CVE-2025-49828 is a high-severity code injection vulnerability in cyberark conjur, published on 15 Jul 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secrets or templates into the Secrets Manager, Self-Hosted database could take advantage of an exposed API endpoint to execute arbitrary Ruby code within the Secrets Manager process. This issue affects both Secrets Manager, Self-Hosted (formerly Conjur Enterprise) and Conjur OSS. Conjur OSS version 1.21.2 and Secrets Manager, Self-Hosted version 13.5 fix the issue.

Weakness: CWE-1336

Which versions are affected by CVE-2025-49828?

It affects 1 product.

Products include Cyberark Conjur.

How do I fix CVE-2025-49828?

No fix has been published for CVE-2025-49828 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-49828 being exploited?

There is no known exploitation of CVE-2025-49828 in the wild and no public exploit code.

Sources

Also known as GHSA-93hx-v9pv-qrm4.