Critical · published July 15, 2025
🚨 A misconfigured network device could reroute authentication requests straight into an attacker's hands! 🔥 Think of it like a postal worker who accidentally delivers sensitive documents to a random address instead of the intended recipient — the information is now in the wrong hands, and that's a big problem! If exploited, an attacker could intercept authentication requests, potentially gaining unauthorized access to sensitive data and systems. This could lead to devastating breaches, exposing your organization to data theft or manipulation that could wreak havoc.
Think of it like a postal worker who accidentally delivers sensitive documents to a random address instead of the intended recipient — the information is now in the wrong hands, and that's a big problem! This vulnerability in Secrets Manager, Self-Hosted allows attackers to redirect authentication requests to a malicious server due to a misconfiguration in the network device routing traffic to AWS. This flaw affects versions prior to 13.5.1 and 13.6.1 for Secrets Manager, and prior to 1.22.1 for Conjur OSS.
If exploited, an attacker could intercept authentication requests, potentially gaining unauthorized access to sensitive data and systems. This could lead to devastating breaches, exposing your organization to data theft or manipulation that could wreak havoc. To protect against this issue, update Secrets Manager, Self-Hosted to version 13.5.1 or later, and Conjur OSS to version 1.22.1 as soon as possible. Additionally, review your network configurations to ensure routing is secure and checks are in place to prevent unauthorized access. This is fixable! Patch those versions, tighten up your network settings, and you'll be safeguarding your data in no time! 🛡️