CVE-2025-49828: CyberArk Conjur RCE Vulnerability

CVE-2025-49828 Overview

CVE-2025-49828 is a remote code execution vulnerability in CyberArk Conjur, a secrets management and application identity platform for infrastructure. The flaw affects Conjur OSS versions 1.19.5 through 1.21.1 and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) versions 13.1 through 13.4.1. An authenticated attacker with permission to inject secrets or templates into the database can abuse an exposed API endpoint to execute arbitrary Ruby code inside the Secrets Manager process. The issue is tracked under [CWE-1336] (improper neutralization of special elements used in a template engine). CyberArk released fixes in Conjur OSS 1.21.2 and Secrets Manager, Self-Hosted 13.5.

Critical Impact
Authenticated attackers can execute arbitrary Ruby code in the Secrets Manager process, exposing every secret managed by Conjur and compromising downstream infrastructure.

Affected Products

CyberArk Conjur OSS versions 1.19.5 through 1.21.1
CyberArk Secrets Manager, Self-Hosted (formerly Conjur Enterprise) versions 13.1 through 13.4.1
Fixed in Conjur OSS 1.21.2 and Secrets Manager, Self-Hosted 13.5

Discovery Timeline

2025-07-15 - CVE-2025-49828 published to NVD
2025-07-16 - Initial vendor advisory distributed via OpenWall OSS Security
2025-08-08 - Follow-up announcement on OpenWall OSS Security
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49828

Vulnerability Analysis

Conjur uses a template engine to render policy and secret content. The vulnerable code paths fail to neutralize template directives supplied by authenticated users. When an attacker injects a crafted template or secret value, the rendering process evaluates embedded Ruby expressions inside the Secrets Manager process. The result is arbitrary code execution under the privileges of the Conjur service account.

Because Conjur stores and brokers credentials for downstream applications, code execution inside the process exposes every secret it manages. The attacker can read database connection strings, cloud provider API keys, Kubernetes service account tokens, and any other material protected by Conjur. The attacker can also pivot by issuing valid tokens to downstream systems.

Root Cause

The root cause is improper neutralization of special elements in a template expression, classified as [CWE-1336]. User-controlled input flowing into a Ruby template evaluator is rendered without strict allowlisting, permitting evaluation of arbitrary expressions. The exposed API endpoint that triggers rendering does not constrain the template syntax to safe constructs.

Attack Vector

The attack requires network access to the Conjur API and authenticated credentials that grant permission to write secrets or policy templates. An attacker who already holds a host or user identity with update privileges on a policy branch can stage the malicious template, then call the affected API endpoint to trigger evaluation. No user interaction is required. See the CyberArk security advisory GHSA-93hx-v9pv-qrm4 for vendor details.

No verified public proof-of-concept code is available.
Refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2025-49828

Indicators of Compromise

Conjur API requests from authenticated principals that submit unusually large or syntactically complex template/secret payloads.
Spawned child processes from the Conjur Ruby runtime, such as sh, bash, curl, wget, or ruby -e invocations that are not part of normal operation.
Outbound network connections from the Conjur container or host to unexpected destinations following a policy or secret update.
Audit log entries showing rapid policy loads or secret writes followed by access to high-value secrets.

Detection Strategies

Enable and review Conjur audit logs for policy load and secret update events, correlating them with the identity that submitted the change.
Alert on any process execution under the Conjur service user that is not on a strict allowlist of expected binaries.
Inspect template and secret payloads for embedded Ruby expression delimiters such as <%= %> or #{...} interpolation in fields where they are not expected.
Monitor for new or modified host and user identities that gain write access to policy branches outside change-management windows.

Monitoring Recommendations

Forward Conjur audit and application logs to a central SIEM and retain them for the duration of your incident response window.
Baseline normal API call volume and payload size per identity, then alert on deviations.
Track all egress traffic from Conjur hosts and containers, treating any unsolicited outbound connection as a high-priority event.

How to Mitigate CVE-2025-49828

Immediate Actions Required

Upgrade Conjur OSS to version 1.21.2 or later, and Secrets Manager, Self-Hosted to version 13.5 or later.
Audit all host and user identities with write access to policy or secret resources, and revoke privileges that are not strictly required.
Rotate any secrets and API tokens managed by affected Conjur instances, prioritizing high-value credentials such as cloud and database keys.
Review audit logs from the start of the affected version window to identify suspicious policy loads or secret writes.

Patch Information

CyberArk released fixed builds in Conjur OSS 1.21.2 and Secrets Manager, Self-Hosted 13.5. The patch notes and release artifacts are available at the Conjur v1.21.2 release page and the GHSA-93hx-v9pv-qrm4 advisory.

Workarounds

Restrict network access to the Conjur API so only trusted administrative networks and application hosts can reach it.
Reduce the number of identities with update permission on policy branches to the minimum operationally required.
Enforce change-management controls so policy and secret writes require review before they reach Conjur.
If patching is not immediately possible, monitor Conjur audit logs continuously for anomalous policy or secret updates.

bash

# Upgrade Conjur OSS container to the patched release
docker pull cyberark/conjur:1.21.2
docker stop conjur && docker rm conjur
docker run -d --name conjur \
  -e DATABASE_URL="$DATABASE_URL" \
  -e CONJUR_DATA_KEY="$CONJUR_DATA_KEY" \
  -p 80:80 cyberark/conjur:1.21.2

# Verify the running version
docker exec conjur conjurctl --version