Conjur’s logic flaws show how secrets vault trust can collapse

At a glance

What this is: CYATA’s research shows that logic flaws in Conjur’s default AWS IAM flow, host factory checks, and policy templating could combine into a pre-authentication path to remote code execution.

Why it matters: IAM, PAM, and NHI teams need to treat secrets vaults as identity systems with their own trust boundaries, because a vault compromise can hand attackers the keys to other services.

Context

Enterprise secrets vaults are intended to protect the credentials, tokens, and keys that other systems trust, which means their failure mode is not limited to a single application. In this case, the central governance gap is that authentication, authorisation, and template execution were all assumed to remain trustworthy even when attacker-controlled input shaped each step.

For NHI and machine identity programmes, that assumption is especially dangerous because vaults often sit inside CI/CD, Kubernetes, and cloud automation paths. If the vault can be influenced through default behaviour, then the identities it brokers become a vehicle for control-plane compromise rather than a protection layer.

Key questions

Q: What breaks when a secrets vault trusts request data for identity verification?

A: When a secrets vault lets request data influence how identity is verified, an attacker can redirect trust to an endpoint they control or shape the identity assertion itself. The result is not just auth bypass, but collapse of the platform’s trust boundary. Teams should assume any caller-controlled verification parameter is part of the attack surface.

Q: Why do host factory or delegation bugs increase vault compromise risk?

A: They let a caller turn permission on one resource into authority over a different resource type. In practice, that means a small foothold can become token minting or object creation authority, which is exactly how privilege expands inside secrets management workflows.

Q: What are the signs that a secrets platform has unsafe trust boundaries?

A: Look for attacker-influenced routing, resource-type confusion, or template rendering paths that depend on identity metadata. If a platform can accept untrusted input and then use it to decide who to trust or what code to execute, the boundary is already too loose.

Q: Should teams patch vault logic flaws before rotating secrets?

A: Yes, because rotation alone does not fix a compromised trust model. If the vault can still be tricked into validating the wrong identity or executing attacker-controlled policy content, newly rotated secrets may be issued and exposed through the same broken path.

Technical breakdown

AWS IAM authentication bypass through region confusion

Conjur’s AWS IAM flow relies on a signed request being verified against the correct STS endpoint. The flaw described here is not cryptographic failure but trust in attacker-influenced parsing: the region is extracted from header content and then used to construct the verification host. If an attacker can alter that parsing outcome, Conjur may send verification to a domain the attacker controls and accept a forged identity response. The mechanism matters because the system treats validation metadata as trustworthy input instead of as part of the attack surface.

Practical implication: validate all verification metadata server-side and treat request-derived routing values as security-sensitive inputs.

Host factory kind mismatch turns ownership into arbitrary host creation

Host factory flows are meant to mint hosts only when the caller has the right relationship to a real host factory resource. The issue here is that Conjur’s permission checks reportedly validated execute permission without confirming the target was actually a host factory. That kind mismatch lets ownership on another resource, such as a group, substitute for the intended resource type. In identity terms, the control failed because authorisation was tied to permission shape, not to resource semantics.

Practical implication: enforce resource-type validation before token issuance so permissions cannot be replayed across different object classes.

Policy templating becomes code execution when identity and content boundaries blur

Policy factories that render ERB templates turn policy data into executable logic. In a secure design, only controlled template material should reach the renderer, and only the correct resource type should be able to supply it. Here, the exploit chain used arbitrary host creation to place attacker-controlled content where Conjur later expected a policy template, then triggered rendering. The deeper issue is that secrets platforms often combine identity, metadata, and execution in one policy engine, so a weak boundary in any one layer can become command execution in another.

Practical implication: separate identity lookups from template execution and constrain any render path to trusted, typed inputs only.

Threat narrative

Attacker objective: The attacker’s objective is to move from unauthenticated access to full control of the secrets vault, then use that position to execute code and compromise the identities and secrets it protects.

1. Entry occurred through a pre-authentication AWS IAM validation flaw that let attacker-supplied header content redirect Conjur’s trust check to a controlled STS endpoint. This produced a forged identity assertion without any real AWS credentials.
2. Escalation followed when the attacker authenticated as a privileged resource type and abused host factory logic to obtain token-like authority through a kind mismatch. The system treated ownership of another resource as sufficient to mint new hosts.
3. Impact came when crafted host identifiers and attacker-controlled ERB content were fed into the policy factory path, turning policy rendering into arbitrary code execution. The result was full control of the Conjur deployment.

Breaches seen in the wild

• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Secrets vault trust is an identity problem before it is a storage problem. Conjur failed because the system trusted request-derived metadata, resource typing, and policy rendering as if each layer were independently safe. That is a structural governance failure in NHI systems that broker access for everything else, because one weak trust boundary can collapse the whole control plane. Practitioners should treat vault validation paths as identity-critical attack surfaces, not implementation details.

Resource semantics must outrank permission shape in NHI governance. This exploit worked because execute permission on one object could be reused against a different object class. That is not a simple access control bug, it is a failure to bind privilege to the correct resource meaning. The implication for IAM and PAM teams is that type confusion in policy engines can turn ordinary entitlements into privilege minting mechanisms.

Policy templating creates an identity-to-code bridge that expands blast radius. When a secrets platform renders templates dynamically, identity compromise can become code execution without a separate application exploit. That is why vaults used in automation pipelines need stricter separation between authentication, authorisation, and execution contexts. The practitioner conclusion is clear: any system that can transform identity metadata into executable policy deserves higher assurance than a standard secrets store.

Default configuration cannot be treated as a safe operating state for secrets brokers. The article shows how default AWS integration behaviour and standard requests were enough to drive the exploit chain. That means hardening cannot be optional or deferred to later lifecycle stages. Teams should assume the attacker will start from default trust assumptions and look for paths that survive first-run deployment settings.

Ephemeral trust collapse is a better concept than simple credential theft for this class of breach. The attacker did not need stolen passwords or long-lived tokens; they subverted the trust system that would normally issue or validate them. That makes the failure mode more severe than ordinary secret exposure because the broker itself becomes the credential source. Security leaders should prioritise validation integrity over perimeter-only secret protection.

From our research library:

• 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
• Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
• Read next: Guide to the Secret Sprawl Challenge

What this signals

Identity blast radius is the right lens for this class of vault failure. A secrets broker that can be turned into a trust oracle does not just expose one credential set, it multiplies access across every workload that depends on it. That is why vault governance has to be treated as part of the identity plane, not as a separate utility service.

Default integration paths are where hidden governance debt accumulates. CI/CD, Kubernetes, and cloud automation often inherit trust from deployment defaults, which makes them attractive targets when validation is weak. Teams should focus on the exact request paths used at runtime, because those are the places where identity assumptions are actually enforced.

For practitioners

• Harden STS verification inputs Stop deriving verification endpoints from attacker-controlled headers or parameters. Bind region and endpoint selection to server-side policy and reject malformed domain fragments before any upstream trust call is made.
• Validate resource kinds before token issuance Require the target object to match the expected type before issuing host factory tokens or similar delegation artifacts. Permission checks should fail when the object class does not match the intended workflow.
• Separate policy data from executable templates Do not allow untrusted identity objects, secrets, or metadata to flow into ERB or any other renderer that can execute logic. Keep rendering confined to trusted, typed inputs and isolate the execution path.
• Review default integration paths as attack paths Audit every default authentication integration, especially those used in CI/CD and cloud automation, for assumptions about identity source, resource type, and fallback behaviour. Default settings should be treated as exposure points until proven otherwise.
• Re-test secret broker trust boundaries after vendor fixes Patch quickly, then revalidate the specific request flows that were abused here: authentication parsing, host factory delegation, and policy rendering. Fixes that address one layer but leave the chain intact will not remove the operational risk.

Key takeaways

• The breach shows that a secrets vault can fail as an identity broker long before it fails as a storage system.
• The attack chain moved from unauthenticated entry to resource abuse and ended in code execution through ordinary requests.
• The control gap was the absence of strict validation between identity parsing, resource typing, and template execution.

Key terms

• Secrets Vault: A centralised, encrypted store for managing secrets such as API keys, passwords, certificates, and tokens. Examples include HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and Akeyless.
• Host factory: A host factory is a delegated mechanism that mints new machine identities or host resources under policy control. In this article’s context, the risk is not just creation, but whether the factory correctly verifies the type, ownership, and scope of the resource being authorised.
• Policy Templating: Policy templating is the process of generating or applying access policy from reusable templates. It becomes risky when template rendering can process executable content, because identity metadata can then cross into code execution rather than remaining a declarative control.
• Trust boundary collapse: Trust boundary collapse occurs when a control that is supposed to validate or constrain identity can be redirected by attacker-controlled input. The result is that downstream access decisions inherit a false assumption, which can convert a minor parsing flaw into full system compromise.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.