Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Execution
Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secrets or templates into the Secrets Manager, Self-Hosted database could take advantage of an exposed API endpoint to execute arbitrary Ruby code within the Secrets Manager process. This issue affects both Secrets Manager, Self-Hosted (formerly Conjur Enterprise) and Conjur OSS. Conjur OSS version 1.21.2 and Secrets Manager, Self-Hosted version 13.5 fix the issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-49828
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 03:13 UTC · Revision 1
Source evidence
Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Execution
core-osv · Original sourcePublished 15 Jul 2025, 19:35 UTC
Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secrets or templates into the Secrets Manager, Self-Hosted database could take advantage of an exposed API endpoint to execute arbitrary Ruby code within the Secrets Manager process. This issue affects both Secrets Manager, Self-Hosted (formerly Conjur Enterprise) and Conjur OSS. Conjur OSS version 1.21.2 and Secrets Manager, Self-Hosted version 13.5 fix the issue.
osv:CVE-2025-49828
Complete source record
{
"id": "9bf40c05baab0f7f6fcfff92ed4812d463cc7ef1f330df0e1741cb58ec39f4f5",
"url": "https://osv.dev/vulnerability/CVE-2025-49828",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Remote Code Execution",
"summary": "Conjur provides secrets management and application identity for infrastructure. Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) 13.1 through 13.4.1 are vulnerable to remote code execution An authenticated attacker who can inject secrets or templates into the Secrets Manager, Self-Hosted database could take advantage of an exposed API endpoint to execute arbitrary Ruby code within the Secrets Manager process. This issue affects both Secrets Manager, Self-Hosted (formerly Conjur Enterprise) and Conjur OSS. Conjur OSS version 1.21.2 and Secrets Manager, Self-Hosted version 13.5 fix the issue.",
"evidence": "osv:CVE-2025-49828",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-49828",
"aliases": [
"CVE-2025-49828",
"GHSA-93hx-v9pv-qrm4"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/cyberark/conjur",
"type": "GIT",
"events": [
{
"introduced": "13777635cf93eaa58a71e790a93710a6ae45f7ca"
},
{
"fixed": "4a4fd0ef5777f206dc773e504e6d17e8fa28f00a"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "1.19.5"
},
{
"last_affected": "1.21.1"
}
],
"source": "DESCRIPTION"
},
{
"range": [
{
"fixed": "4a4fd0ef5777f206dc773e504e6d17e8fa28f00a"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.21.2"
}
]
}
}
],
"versions": [
"v1.20.1-4405",
"v1.20.1-4404",
"v1.20.1-4400",
"v1.20.1-4395",
"v1.20.1-4385",
"v1.20.1-4383",
"v1.20.1-4378",
"v1.20.1-4377",
"v1.20.1-4372",
"v1.20.1-4368",
"v1.20.1-4362",
"v1.20.1-4353",
"v1.20.0-4262",
"v1.20.0",
"v1.20.0-4256",
"v1.20.0-4255",
"v1.20.0-4250",
"v1.20.0-4249",
"v1.20.0-4238",
"v1.20.0-4231",
"v1.20.0-4230",
"v1.20.0-4229",
"v1.20.0-4224",
"v1.20.0-4223",
"v1.20.0-4222",
"v1.20.0-4219",
"v1.20.0-4218",
"v1.20.0-4214",
"v1.20.0-4212",
"v1.20.0-4198",
"v1.20.0-4191",
"v1.20.0-4187",
"v1.20.0-4183",
"v1.20.0-4180",
"v1.20.0-4177",
"v1.20.0-4164",
"v1.20.0-4161",
"v1.20.0-4157",
"v1.20.0-4153",
"v1.20.0-4132",
"v1.20.0-4131",
"v1.20.0-4127",
"v1.20.0-4126",
"v1.20.0-4125",
"v1.20.0-4115",
"v1.20.0-4107",
"v1.20.0-4105",
"v1.20.0-4104",
"v1.20.0-4095",
"v1.20.0-4088",
"v1.20.0-4077",
"v1.20.0-4076",
"v1.20.0-4072",
"v1.20.0-4071",
"v1.20.0-4069",
"v1.20.0-4083",
"v1.19.6-4066",
"v1.19.6-4065",
"v1.19.6-4061",
"v1.19.6-4060",
"v1.19.6-4056",
"v1.19.6-4050",
"v1.19.6-4046",
"v1.19.6-4045",
"v1.19.6-4041",
"v1.19.6-4040",
"v1.19.6-4038",
"v1.19.6-4037",
"v1.19.6-4027",
"v1.19.6-4023",
"v1.19.6-4019",
"v1.19.6-4016",
"v1.19.6-4004",
"v1.19.6-4003",
"v1.19.6-4000",
"v1.19.6-3999",
"v1.19.6-3994",
"v1.19.6-3990",
"v1.19.6-3989",
"v1.19.6-3985",
"v1.19.6-3984",
"v1.19.6-3979",
"v1.19.6-3974",
"v1.19.6-3969",
"v1.19.6-3968",
"v1.19.6-3961",
"v1.19.6-3960",
"v1.19.6-3955",
"v1.19.6-3954",
"v1.19.6-3949",
"v1.19.6-3948",
"v1.19.5-3915",
"v1.19.5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49828.json"
}
}
],
"modified": "2026-10-28T02:30:33.022264692Z",
"provider": "osv",
"references": [
"https://github.com/cyberark/conjur/releases/tag/v1.21.2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49828.json",
"https://github.com/cyberark/conjur/security/advisories/GHSA-93hx-v9pv-qrm4",
"https://nvd.nist.gov/vuln/detail/CVE-2025-49828"
],
"provider_metadata": {
"cwe_ids": [
"CWE-1336"
],
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "Conjur OSS >= 1.20.1, < 1.21.2"
},
{
"last_affected": "Conjur OSS >= 1.20.1, < 1.21.2"
},
{
"introduced": "Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) >= 13.1, < 13.5"
},
{
"last_affected": "Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) >= 13.1, < 13.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
},
{
"extracted_events": [
{
"range": [
{
"introduced": "13.1"
},
{
"last_affected": "13.4.1"
}
],
"source": "DESCRIPTION"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49828.json"
}
},
"related_cves": [
{
"value": "CVE-2025-49828",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 499958,
"published_at": "2025-07-15T19:35:33.147+00:00"
}