CVE-2026-4387: StrongDM Information Disclosure Flaw

CVE-2026-4387 Overview

CVE-2026-4387 is a cleartext storage vulnerability [CWE-312] in the StrongDM Desktop Application on Microsoft Windows. Affected versions store authentication state, including a JSON Web Token (JWT) and asymmetric key material, in cleartext within a per-user state file at C:\Users\<username>\.sdm\state.kv. The file relies solely on default user-level NTFS permissions for protection.

An attacker with local read access to the affected user's profile directory can recover credentials and reuse them to impersonate the user against StrongDM-managed resources. The vulnerability was reported through coordinated disclosure by Hope Walker of SpecterOps.

Critical Impact
Local attackers or malicious code running in the user's context can harvest JWTs and key material from state.kv and reuse them to authenticate to StrongDM-managed infrastructure as the legitimate user.

Affected Products

StrongDM Desktop Application before version 23.74.0 on Microsoft Windows
StrongDM Desktop Client before version 53.77.0 on Microsoft Windows
Deployments where the per-user state file C:\Users\<username>\.sdm\state.kv is generated

Discovery Timeline

2026-05-29 - CVE-2026-4387 published to NVD
2026-06-01 - Last updated in NVD database; SpecterOps publishes analysis by Hope Walker

Technical Details for CVE-2026-4387

Vulnerability Analysis

The StrongDM Desktop Application maintains client authentication state on disk so the user does not have to re-authenticate between sessions. On Windows, this state is written to C:\Users\<username>\.sdm\state.kv as cleartext key-value data. The file contains a valid JWT used to authenticate to StrongDM services and asymmetric key material associated with the user's session.

Windows does not encrypt the file at rest, and the application does not wrap the secrets with platform-bound mechanisms such as the Data Protection API (DPAPI). Access control is enforced only by the default NTFS access control list (ACL) inherited by files created under the user profile. Any process running in the user's context, any account with administrative privileges, and any actor able to read the user's profile directory through backup, shadow copy, or remote share access can extract the credentials.

Reuse of the extracted JWT and key material allows the attacker to authenticate to StrongDM as the targeted user from a separate host, subject to deployment-specific execution conditions on the original target. This places sensitive credentials in scope of common post-exploitation tooling that collects browser tokens, SSH keys, and cloud CLI secrets.

Root Cause

The root cause is improper protection of stored credentials [CWE-312]. The application persists high-value secrets to disk without applying user-bound encryption, hardware-backed storage, or restrictive discretionary ACLs beyond Windows defaults.

Attack Vector

Exploitation requires local read access to the victim user's profile directory. Typical paths include malware executing in the user's session, lateral movement from an administrator account, recovery from Volume Shadow Copies, or examination of host backups. The attacker copies state.kv, extracts the JWT and key material, and replays them from an attacker-controlled host to access StrongDM-managed resources.

No verified public exploit code is available. Refer to the SpecterOps CVE-2026-4387 Analysis for the disclosure write-up.

Detection Methods for CVE-2026-4387

Indicators of Compromise

Read access to C:\Users\<username>\.sdm\state.kv by processes other than the StrongDM Desktop Application or Desktop Client
Copy, archive, or exfiltration operations targeting the .sdm directory under user profiles
StrongDM authentication events for a user originating from a host or IP address that differs from the user's normal endpoint

Detection Strategies

Deploy file integrity and access monitoring on %USERPROFILE%\.sdm\state.kv to flag reads outside of the StrongDM client process tree
Correlate StrongDM audit logs with endpoint telemetry to identify session reuse from unexpected source addresses or device identifiers
Hunt for credential-harvesting tools and scripts referencing state.kv, .sdm, or StrongDM JWT patterns

Monitoring Recommendations

Forward StrongDM authentication and session logs to a central SIEM and alert on concurrent sessions for the same user from distinct hosts
Monitor for Volume Shadow Copy access and backup operations that include user profile directories on hosts with StrongDM installed
Track process command lines invoking type, Get-Content, copy, or archive utilities against paths matching \.sdm\state.kv

How to Mitigate CVE-2026-4387

Immediate Actions Required

Upgrade the StrongDM Desktop Application to version 23.74.0 or later, and the Desktop Client to version 53.77.0 or later, on all Windows endpoints
Rotate StrongDM credentials and revoke active sessions for users whose endpoints ran vulnerable versions
Audit StrongDM access logs for unexpected authentications originating outside the user's known endpoints

Patch Information

StrongDM has released fixed versions through the StrongDM Security Update. Apply the Desktop Application 23.74.0 or later, and Desktop Client 53.77.0 or later. Technical context is available in the SpecterOps CVE-2026-4387 Analysis.

Workarounds

Restrict local administrative access on Windows endpoints running the StrongDM client to reduce cross-user read paths to state.kv
Disable or tightly control Volume Shadow Copy and third-party backup access to user profile directories on StrongDM-equipped hosts
Enforce short-lived StrongDM session lifetimes and require re-authentication to limit the value of any captured JWT

bash

# Configuration example: verify installed version and remove stale state after upgrade
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*StrongDM*" } |
  Select-Object DisplayName, DisplayVersion

# After upgrading, remove cached state and force re-authentication
Remove-Item -Path "$env:USERPROFILE\.sdm\state.kv" -Force -ErrorAction SilentlyContinue