{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Daily Security Review","title":"Critical Flaws in CyberArk Conjur and HashiCorp Vault Put Enterprise Secrets at Risk","html":"","width":"100%","height":180,"duration":2249,"description":"Enterprise secrets managers—long considered the most secure components in modern infrastructure—are now under fire. In a groundbreaking report, cybersecurity firm Cyata revealed 14 critical zero-day vulnerabilities across CyberArk Conjur and HashiCorp Vault, exposing flaws that allow unauthenticated attackers to achieve remote code execution (RCE), privilege escalation, and even full system takeover—all without a password or token.\nThese aren’t just theoretical risks. The vulnerabilities could give attackers access to every database, every API key, every cloud resource—the very lifeblood of an enterprise’s security posture. In some cases, Cyata researchers demonstrated that a single unauthenticated API request was enough to completely compromise the vault.\nWe break down the most dangerous findings:\nCyberArk Conjur's vulnerabilities include IAM authenticator bypasses, remote code execution, and file disclosure exploits that could be chained together for total control.\nHashiCorp Vault is hit even harder, with nine critical flaws such as RCE via plugin abuse, MFA and lockout bypasses, and a root privilege escalation bug caused by policy normalization inconsistencies.\nOne Vault bug had been lurking for nine years, silently compromising the trust model for machine identity.\nThese issues highlight a broader shift in cybersecurity—from traditional memory corruption exploits to subtle but devastating logic flaws within authentication and policy enforcement layers. As enterprises move toward automation and DevSecOps, the security of secrets managers is more important than ever—and these discoveries expose how fragile that foundation can be.\nWe also unpack the best practices for secrets management and mitigation:\nPatch now—both vendors have issued urgent fixes.\nAvoid \"Secret Zero\" vulnerabilities.\nRotate secrets regularly, apply least-privilege policies, and never hardcode secrets.\nEmbrace secure SDLC practices with red teaming, static analysis, and shift-left threat...","thumbnail_url":"https://img.transistorcdn.com/pL79_MJFeJHamQ_ztImsGmDSMdl27VMk_30TAkieujE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNzg5/ZjlhNzM5Y2M4Njli/NjkxNzgyODA2Nzhi/MDI2ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}