Topic starter
09/07/2026 3:28 pm
TL;DR: A pre-authentication RCE chain built from logic flaws in AWS IAM authentication, host factory handling, and policy templating was found in CyberArk Conjur, letting an attacker move from zero access to full control using default behaviour and standard requests, according to CYATA research.
Editorial analysis by NHI Mgmt Group, based on content published by CYATA: “Exploiting a full chain of trust flaws: how we went from unauthenticated to arbitrary remote code execution (RCE) in CyberArk Conjur”.
Key questions
Q: What breaks when a secrets vault trusts request data for identity verification?
A: When a secrets vault lets request data influence how identity is verified, an attacker can redirect trust to an endpoint they control or shape the identity assertion itself.
Q: Why do host factory or delegation bugs increase vault compromise risk?
A: They let a caller turn permission on one resource into authority over a different resource type.
Q: What are the signs that a secrets platform has unsafe trust boundaries?
A: Look for attacker-influenced routing, resource-type confusion, or template rendering paths that depend on identity metadata.
Practitioner guidance
- Harden STS verification inputs Stop deriving verification endpoints from attacker-controlled headers or parameters.
- Validate resource kinds before token issuance Require the target object to match the expected type before issuing host factory tokens or similar delegation artifacts.
- Separate policy data from executable templates Do not allow untrusted identity objects, secrets, or metadata to flow into ERB or any other renderer that can execute logic.
Bottom line: The breach shows that a secrets vault can fail as an identity broker long before it fails as a storage system.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:49 pm
Secrets vault trust is an identity problem before it is a storage problem. Conjur failed because the system trusted request-derived metadata, resource typing, and policy rendering as if each layer were independently safe. That is a structural governance failure in NHI systems that broker access for everything else, because one weak trust boundary can collapse the whole control plane. Practitioners should treat vault validation paths as identity-critical attack surfaces, not implementation details.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: Should teams patch vault logic flaws before rotating secrets?
A: Yes, because rotation alone does not fix a compromised trust model. If the vault can still be tricked into validating the wrong identity or executing attacker-controlled policy content, newly rotated secrets may be issued and exposed through the same broken path.
👉 Read our full editorial: Conjur’s logic flaws show how secrets vault trust can collapse